1 // SPDX-License-Identifier: GPL-2.0
3 * main.c - Multi purpose firmware loading support
5 * Copyright (c) 2003 Manuel Estrada Sainz
7 * Please see Documentation/driver-api/firmware/ for more information.
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/capability.h>
14 #include <linux/device.h>
15 #include <linux/kernel_read_file.h>
16 #include <linux/module.h>
17 #include <linux/init.h>
18 #include <linux/initrd.h>
19 #include <linux/timer.h>
20 #include <linux/vmalloc.h>
21 #include <linux/interrupt.h>
22 #include <linux/bitops.h>
23 #include <linux/mutex.h>
24 #include <linux/workqueue.h>
25 #include <linux/highmem.h>
26 #include <linux/firmware.h>
27 #include <linux/slab.h>
28 #include <linux/sched.h>
29 #include <linux/file.h>
30 #include <linux/list.h>
32 #include <linux/async.h>
34 #include <linux/suspend.h>
35 #include <linux/syscore_ops.h>
36 #include <linux/reboot.h>
37 #include <linux/security.h>
38 #include <linux/zstd.h>
41 #include <generated/utsrelease.h>
47 MODULE_AUTHOR("Manuel Estrada Sainz");
48 MODULE_DESCRIPTION("Multi purpose firmware loading support");
49 MODULE_LICENSE("GPL");
51 struct firmware_cache
{
52 /* firmware_buf instance will be added into the below list */
54 struct list_head head
;
57 #ifdef CONFIG_FW_CACHE
59 * Names of firmware images which have been cached successfully
60 * will be added into the below list so that device uncache
61 * helper can trace which firmware images have been cached
65 struct list_head fw_names
;
67 struct delayed_work work
;
69 struct notifier_block pm_notify
;
73 struct fw_cache_entry
{
74 struct list_head list
;
83 static inline struct fw_priv
*to_fw_priv(struct kref
*ref
)
85 return container_of(ref
, struct fw_priv
, ref
);
88 #define FW_LOADER_NO_CACHE 0
89 #define FW_LOADER_START_CACHE 1
91 /* fw_lock could be moved to 'struct fw_sysfs' but since it is just
92 * guarding for corner cases a global lock should be OK */
93 DEFINE_MUTEX(fw_lock
);
95 struct firmware_cache fw_cache
;
96 bool fw_load_abort_all
;
98 void fw_state_init(struct fw_priv
*fw_priv
)
100 struct fw_state
*fw_st
= &fw_priv
->fw_st
;
102 init_completion(&fw_st
->completion
);
103 fw_st
->status
= FW_STATUS_UNKNOWN
;
106 static inline int fw_state_wait(struct fw_priv
*fw_priv
)
108 return __fw_state_wait_common(fw_priv
, MAX_SCHEDULE_TIMEOUT
);
111 static void fw_cache_piggyback_on_request(struct fw_priv
*fw_priv
);
113 static struct fw_priv
*__allocate_fw_priv(const char *fw_name
,
114 struct firmware_cache
*fwc
,
120 struct fw_priv
*fw_priv
;
122 /* For a partial read, the buffer must be preallocated. */
123 if ((opt_flags
& FW_OPT_PARTIAL
) && !dbuf
)
126 /* Only partial reads are allowed to use an offset. */
127 if (offset
!= 0 && !(opt_flags
& FW_OPT_PARTIAL
))
130 fw_priv
= kzalloc(sizeof(*fw_priv
), GFP_ATOMIC
);
134 fw_priv
->fw_name
= kstrdup_const(fw_name
, GFP_ATOMIC
);
135 if (!fw_priv
->fw_name
) {
140 kref_init(&fw_priv
->ref
);
142 fw_priv
->data
= dbuf
;
143 fw_priv
->allocated_size
= size
;
144 fw_priv
->offset
= offset
;
145 fw_priv
->opt_flags
= opt_flags
;
146 fw_state_init(fw_priv
);
147 #ifdef CONFIG_FW_LOADER_USER_HELPER
148 INIT_LIST_HEAD(&fw_priv
->pending_list
);
151 pr_debug("%s: fw-%s fw_priv=%p\n", __func__
, fw_name
, fw_priv
);
156 static struct fw_priv
*__lookup_fw_priv(const char *fw_name
)
159 struct firmware_cache
*fwc
= &fw_cache
;
161 list_for_each_entry(tmp
, &fwc
->head
, list
)
162 if (!strcmp(tmp
->fw_name
, fw_name
))
167 /* Returns 1 for batching firmware requests with the same name */
168 int alloc_lookup_fw_priv(const char *fw_name
, struct firmware_cache
*fwc
,
169 struct fw_priv
**fw_priv
, void *dbuf
, size_t size
,
170 size_t offset
, u32 opt_flags
)
174 spin_lock(&fwc
->lock
);
176 * Do not merge requests that are marked to be non-cached or
177 * are performing partial reads.
179 if (!(opt_flags
& (FW_OPT_NOCACHE
| FW_OPT_PARTIAL
))) {
180 tmp
= __lookup_fw_priv(fw_name
);
183 spin_unlock(&fwc
->lock
);
185 pr_debug("batched request - sharing the same struct fw_priv and lookup for multiple requests\n");
190 tmp
= __allocate_fw_priv(fw_name
, fwc
, dbuf
, size
, offset
, opt_flags
);
192 INIT_LIST_HEAD(&tmp
->list
);
193 if (!(opt_flags
& FW_OPT_NOCACHE
))
194 list_add(&tmp
->list
, &fwc
->head
);
196 spin_unlock(&fwc
->lock
);
200 return tmp
? 0 : -ENOMEM
;
203 static void __free_fw_priv(struct kref
*ref
)
204 __releases(&fwc
->lock
)
206 struct fw_priv
*fw_priv
= to_fw_priv(ref
);
207 struct firmware_cache
*fwc
= fw_priv
->fwc
;
209 pr_debug("%s: fw-%s fw_priv=%p data=%p size=%u\n",
210 __func__
, fw_priv
->fw_name
, fw_priv
, fw_priv
->data
,
211 (unsigned int)fw_priv
->size
);
213 list_del(&fw_priv
->list
);
214 spin_unlock(&fwc
->lock
);
216 if (fw_is_paged_buf(fw_priv
))
217 fw_free_paged_buf(fw_priv
);
218 else if (!fw_priv
->allocated_size
)
219 vfree(fw_priv
->data
);
221 kfree_const(fw_priv
->fw_name
);
225 void free_fw_priv(struct fw_priv
*fw_priv
)
227 struct firmware_cache
*fwc
= fw_priv
->fwc
;
228 spin_lock(&fwc
->lock
);
229 if (!kref_put(&fw_priv
->ref
, __free_fw_priv
))
230 spin_unlock(&fwc
->lock
);
233 #ifdef CONFIG_FW_LOADER_PAGED_BUF
234 bool fw_is_paged_buf(struct fw_priv
*fw_priv
)
236 return fw_priv
->is_paged_buf
;
239 void fw_free_paged_buf(struct fw_priv
*fw_priv
)
246 vunmap(fw_priv
->data
);
248 for (i
= 0; i
< fw_priv
->nr_pages
; i
++)
249 __free_page(fw_priv
->pages
[i
]);
250 kvfree(fw_priv
->pages
);
251 fw_priv
->pages
= NULL
;
252 fw_priv
->page_array_size
= 0;
253 fw_priv
->nr_pages
= 0;
254 fw_priv
->data
= NULL
;
258 int fw_grow_paged_buf(struct fw_priv
*fw_priv
, int pages_needed
)
260 /* If the array of pages is too small, grow it */
261 if (fw_priv
->page_array_size
< pages_needed
) {
262 int new_array_size
= max(pages_needed
,
263 fw_priv
->page_array_size
* 2);
264 struct page
**new_pages
;
266 new_pages
= kvmalloc_array(new_array_size
, sizeof(void *),
270 memcpy(new_pages
, fw_priv
->pages
,
271 fw_priv
->page_array_size
* sizeof(void *));
272 memset(&new_pages
[fw_priv
->page_array_size
], 0, sizeof(void *) *
273 (new_array_size
- fw_priv
->page_array_size
));
274 kvfree(fw_priv
->pages
);
275 fw_priv
->pages
= new_pages
;
276 fw_priv
->page_array_size
= new_array_size
;
279 while (fw_priv
->nr_pages
< pages_needed
) {
280 fw_priv
->pages
[fw_priv
->nr_pages
] =
281 alloc_page(GFP_KERNEL
| __GFP_HIGHMEM
);
283 if (!fw_priv
->pages
[fw_priv
->nr_pages
])
291 int fw_map_paged_buf(struct fw_priv
*fw_priv
)
293 /* one pages buffer should be mapped/unmapped only once */
297 vunmap(fw_priv
->data
);
298 fw_priv
->data
= vmap(fw_priv
->pages
, fw_priv
->nr_pages
, 0,
308 * ZSTD-compressed firmware support
310 #ifdef CONFIG_FW_LOADER_COMPRESS_ZSTD
311 static int fw_decompress_zstd(struct device
*dev
, struct fw_priv
*fw_priv
,
312 size_t in_size
, const void *in_buffer
)
314 size_t len
, out_size
, workspace_size
;
315 void *workspace
, *out_buf
;
319 if (fw_priv
->allocated_size
) {
320 out_size
= fw_priv
->allocated_size
;
321 out_buf
= fw_priv
->data
;
323 zstd_frame_header params
;
325 if (zstd_get_frame_header(¶ms
, in_buffer
, in_size
) ||
326 params
.frameContentSize
== ZSTD_CONTENTSIZE_UNKNOWN
) {
327 dev_dbg(dev
, "%s: invalid zstd header\n", __func__
);
330 out_size
= params
.frameContentSize
;
331 out_buf
= vzalloc(out_size
);
336 workspace_size
= zstd_dctx_workspace_bound();
337 workspace
= kvzalloc(workspace_size
, GFP_KERNEL
);
343 ctx
= zstd_init_dctx(workspace
, workspace_size
);
345 dev_dbg(dev
, "%s: failed to initialize context\n", __func__
);
350 len
= zstd_decompress_dctx(ctx
, out_buf
, out_size
, in_buffer
, in_size
);
351 if (zstd_is_error(len
)) {
352 dev_dbg(dev
, "%s: failed to decompress: %d\n", __func__
,
353 zstd_get_error_code(len
));
358 if (!fw_priv
->allocated_size
)
359 fw_priv
->data
= out_buf
;
365 if (err
&& !fw_priv
->allocated_size
)
369 #endif /* CONFIG_FW_LOADER_COMPRESS_ZSTD */
372 * XZ-compressed firmware support
374 #ifdef CONFIG_FW_LOADER_COMPRESS_XZ
375 /* show an error and return the standard error code */
376 static int fw_decompress_xz_error(struct device
*dev
, enum xz_ret xz_ret
)
378 if (xz_ret
!= XZ_STREAM_END
) {
379 dev_warn(dev
, "xz decompression failed (xz_ret=%d)\n", xz_ret
);
380 return xz_ret
== XZ_MEM_ERROR
? -ENOMEM
: -EINVAL
;
385 /* single-shot decompression onto the pre-allocated buffer */
386 static int fw_decompress_xz_single(struct device
*dev
, struct fw_priv
*fw_priv
,
387 size_t in_size
, const void *in_buffer
)
389 struct xz_dec
*xz_dec
;
390 struct xz_buf xz_buf
;
393 xz_dec
= xz_dec_init(XZ_SINGLE
, (u32
)-1);
397 xz_buf
.in_size
= in_size
;
398 xz_buf
.in
= in_buffer
;
400 xz_buf
.out_size
= fw_priv
->allocated_size
;
401 xz_buf
.out
= fw_priv
->data
;
404 xz_ret
= xz_dec_run(xz_dec
, &xz_buf
);
407 fw_priv
->size
= xz_buf
.out_pos
;
408 return fw_decompress_xz_error(dev
, xz_ret
);
411 /* decompression on paged buffer and map it */
412 static int fw_decompress_xz_pages(struct device
*dev
, struct fw_priv
*fw_priv
,
413 size_t in_size
, const void *in_buffer
)
415 struct xz_dec
*xz_dec
;
416 struct xz_buf xz_buf
;
421 xz_dec
= xz_dec_init(XZ_DYNALLOC
, (u32
)-1);
425 xz_buf
.in_size
= in_size
;
426 xz_buf
.in
= in_buffer
;
429 fw_priv
->is_paged_buf
= true;
432 if (fw_grow_paged_buf(fw_priv
, fw_priv
->nr_pages
+ 1)) {
437 /* decompress onto the new allocated page */
438 page
= fw_priv
->pages
[fw_priv
->nr_pages
- 1];
439 xz_buf
.out
= kmap_local_page(page
);
441 xz_buf
.out_size
= PAGE_SIZE
;
442 xz_ret
= xz_dec_run(xz_dec
, &xz_buf
);
443 kunmap_local(xz_buf
.out
);
444 fw_priv
->size
+= xz_buf
.out_pos
;
445 /* partial decompression means either end or error */
446 if (xz_buf
.out_pos
!= PAGE_SIZE
)
448 } while (xz_ret
== XZ_OK
);
450 err
= fw_decompress_xz_error(dev
, xz_ret
);
452 err
= fw_map_paged_buf(fw_priv
);
459 static int fw_decompress_xz(struct device
*dev
, struct fw_priv
*fw_priv
,
460 size_t in_size
, const void *in_buffer
)
462 /* if the buffer is pre-allocated, we can perform in single-shot mode */
464 return fw_decompress_xz_single(dev
, fw_priv
, in_size
, in_buffer
);
466 return fw_decompress_xz_pages(dev
, fw_priv
, in_size
, in_buffer
);
468 #endif /* CONFIG_FW_LOADER_COMPRESS_XZ */
470 /* direct firmware loading support */
471 static char fw_path_para
[256];
472 static const char * const fw_path
[] = {
474 "/lib/firmware/updates/" UTS_RELEASE
,
475 "/lib/firmware/updates",
476 "/lib/firmware/" UTS_RELEASE
,
481 * Typical usage is that passing 'firmware_class.path=$CUSTOMIZED_PATH'
482 * from kernel command line because firmware_class is generally built in
483 * kernel instead of module.
485 module_param_string(path
, fw_path_para
, sizeof(fw_path_para
), 0644);
486 MODULE_PARM_DESC(path
, "customized firmware image search path with a higher priority than default path");
489 fw_get_filesystem_firmware(struct device
*device
, struct fw_priv
*fw_priv
,
491 int (*decompress
)(struct device
*dev
,
492 struct fw_priv
*fw_priv
,
494 const void *in_buffer
))
497 int i
, len
, maxlen
= 0;
499 char *path
, *nt
= NULL
;
500 size_t msize
= INT_MAX
;
503 /* Already populated data member means we're loading into a buffer */
504 if (!decompress
&& fw_priv
->data
) {
505 buffer
= fw_priv
->data
;
506 msize
= fw_priv
->allocated_size
;
513 wait_for_initramfs();
514 for (i
= 0; i
< ARRAY_SIZE(fw_path
); i
++) {
515 size_t file_size
= 0;
516 size_t *file_size_ptr
= NULL
;
518 /* skip the unset customized path */
522 /* strip off \n from customized path */
523 maxlen
= strlen(fw_path
[i
]);
525 nt
= strchr(fw_path
[i
], '\n');
527 maxlen
= nt
- fw_path
[i
];
530 len
= snprintf(path
, PATH_MAX
, "%.*s/%s%s",
532 fw_priv
->fw_name
, suffix
);
533 if (len
>= PATH_MAX
) {
541 * The total file size is only examined when doing a partial
542 * read; the "full read" case needs to fail if the whole
543 * firmware was not completely loaded.
545 if ((fw_priv
->opt_flags
& FW_OPT_PARTIAL
) && buffer
)
546 file_size_ptr
= &file_size
;
548 /* load firmware files from the mount namespace of init */
549 rc
= kernel_read_file_from_path_initns(path
, fw_priv
->offset
,
554 if (!(fw_priv
->opt_flags
& FW_OPT_NO_WARN
)) {
557 "loading %s failed with error %d\n",
561 "loading %s failed for no such file or directory.\n",
569 dev_dbg(device
, "Loading firmware from %s\n", path
);
571 dev_dbg(device
, "f/w decompressing %s\n",
573 rc
= decompress(device
, fw_priv
, size
, buffer
);
574 /* discard the superfluous original content */
578 fw_free_paged_buf(fw_priv
);
582 dev_dbg(device
, "direct-loading %s\n",
585 fw_priv
->data
= buffer
;
586 fw_priv
->size
= size
;
588 fw_state_done(fw_priv
);
596 /* firmware holds the ownership of pages */
597 static void firmware_free_data(const struct firmware
*fw
)
599 /* Loaded directly? */
604 free_fw_priv(fw
->priv
);
607 /* store the pages buffer info firmware from buf */
608 static void fw_set_page_data(struct fw_priv
*fw_priv
, struct firmware
*fw
)
611 fw
->size
= fw_priv
->size
;
612 fw
->data
= fw_priv
->data
;
614 pr_debug("%s: fw-%s fw_priv=%p data=%p size=%u\n",
615 __func__
, fw_priv
->fw_name
, fw_priv
, fw_priv
->data
,
616 (unsigned int)fw_priv
->size
);
619 #ifdef CONFIG_FW_CACHE
620 static void fw_name_devm_release(struct device
*dev
, void *res
)
622 struct fw_name_devm
*fwn
= res
;
624 if (fwn
->magic
== (unsigned long)&fw_cache
)
625 pr_debug("%s: fw_name-%s devm-%p released\n",
626 __func__
, fwn
->name
, res
);
627 kfree_const(fwn
->name
);
630 static int fw_devm_match(struct device
*dev
, void *res
,
633 struct fw_name_devm
*fwn
= res
;
635 return (fwn
->magic
== (unsigned long)&fw_cache
) &&
636 !strcmp(fwn
->name
, match_data
);
639 static struct fw_name_devm
*fw_find_devm_name(struct device
*dev
,
642 struct fw_name_devm
*fwn
;
644 fwn
= devres_find(dev
, fw_name_devm_release
,
645 fw_devm_match
, (void *)name
);
649 static bool fw_cache_is_setup(struct device
*dev
, const char *name
)
651 struct fw_name_devm
*fwn
;
653 fwn
= fw_find_devm_name(dev
, name
);
660 /* add firmware name into devres list */
661 static int fw_add_devm_name(struct device
*dev
, const char *name
)
663 struct fw_name_devm
*fwn
;
665 if (fw_cache_is_setup(dev
, name
))
668 fwn
= devres_alloc(fw_name_devm_release
, sizeof(struct fw_name_devm
),
672 fwn
->name
= kstrdup_const(name
, GFP_KERNEL
);
678 fwn
->magic
= (unsigned long)&fw_cache
;
679 devres_add(dev
, fwn
);
684 static bool fw_cache_is_setup(struct device
*dev
, const char *name
)
689 static int fw_add_devm_name(struct device
*dev
, const char *name
)
695 int assign_fw(struct firmware
*fw
, struct device
*device
)
697 struct fw_priv
*fw_priv
= fw
->priv
;
700 mutex_lock(&fw_lock
);
701 if (!fw_priv
->size
|| fw_state_is_aborted(fw_priv
)) {
702 mutex_unlock(&fw_lock
);
707 * add firmware name into devres list so that we can auto cache
708 * and uncache firmware for device.
710 * device may has been deleted already, but the problem
711 * should be fixed in devres or driver core.
713 /* don't cache firmware handled without uevent */
714 if (device
&& (fw_priv
->opt_flags
& FW_OPT_UEVENT
) &&
715 !(fw_priv
->opt_flags
& FW_OPT_NOCACHE
)) {
716 ret
= fw_add_devm_name(device
, fw_priv
->fw_name
);
718 mutex_unlock(&fw_lock
);
724 * After caching firmware image is started, let it piggyback
725 * on request firmware.
727 if (!(fw_priv
->opt_flags
& FW_OPT_NOCACHE
) &&
728 fw_priv
->fwc
->state
== FW_LOADER_START_CACHE
)
729 fw_cache_piggyback_on_request(fw_priv
);
731 /* pass the pages buffer to driver at the last minute */
732 fw_set_page_data(fw_priv
, fw
);
733 mutex_unlock(&fw_lock
);
737 /* prepare firmware and firmware_buf structs;
738 * return 0 if a firmware is already assigned, 1 if need to load one,
739 * or a negative error code
742 _request_firmware_prepare(struct firmware
**firmware_p
, const char *name
,
743 struct device
*device
, void *dbuf
, size_t size
,
744 size_t offset
, u32 opt_flags
)
746 struct firmware
*firmware
;
747 struct fw_priv
*fw_priv
;
750 *firmware_p
= firmware
= kzalloc(sizeof(*firmware
), GFP_KERNEL
);
752 dev_err(device
, "%s: kmalloc(struct firmware) failed\n",
757 if (firmware_request_builtin_buf(firmware
, name
, dbuf
, size
)) {
758 dev_dbg(device
, "using built-in %s\n", name
);
759 return 0; /* assigned */
762 ret
= alloc_lookup_fw_priv(name
, &fw_cache
, &fw_priv
, dbuf
, size
,
766 * bind with 'priv' now to avoid warning in failure path
767 * of requesting firmware.
769 firmware
->priv
= fw_priv
;
772 ret
= fw_state_wait(fw_priv
);
774 fw_set_page_data(fw_priv
, firmware
);
775 return 0; /* assigned */
781 return 1; /* need to load */
785 * Batched requests need only one wake, we need to do this step last due to the
786 * fallback mechanism. The buf is protected with kref_get(), and it won't be
787 * released until the last user calls release_firmware().
789 * Failed batched requests are possible as well, in such cases we just share
790 * the struct fw_priv and won't release it until all requests are woken
791 * and have gone through this same path.
793 static void fw_abort_batch_reqs(struct firmware
*fw
)
795 struct fw_priv
*fw_priv
;
797 /* Loaded directly? */
798 if (!fw
|| !fw
->priv
)
802 mutex_lock(&fw_lock
);
803 if (!fw_state_is_aborted(fw_priv
))
804 fw_state_aborted(fw_priv
);
805 mutex_unlock(&fw_lock
);
808 #if defined(CONFIG_FW_LOADER_DEBUG)
809 #include <crypto/hash.h>
810 #include <crypto/sha2.h>
812 static void fw_log_firmware_info(const struct firmware
*fw
, const char *name
, struct device
*device
)
814 struct shash_desc
*shash
;
815 struct crypto_shash
*alg
;
819 alg
= crypto_alloc_shash("sha256", 0, 0);
823 sha256buf
= kmalloc(SHA256_DIGEST_SIZE
, GFP_KERNEL
);
824 outbuf
= kmalloc(SHA256_BLOCK_SIZE
+ 1, GFP_KERNEL
);
825 shash
= kmalloc(sizeof(*shash
) + crypto_shash_descsize(alg
), GFP_KERNEL
);
826 if (!sha256buf
|| !outbuf
|| !shash
)
831 if (crypto_shash_digest(shash
, fw
->data
, fw
->size
, sha256buf
) < 0)
834 for (int i
= 0; i
< SHA256_DIGEST_SIZE
; i
++)
835 sprintf(&outbuf
[i
* 2], "%02x", sha256buf
[i
]);
836 outbuf
[SHA256_BLOCK_SIZE
] = 0;
837 dev_dbg(device
, "Loaded FW: %s, sha256: %s\n", name
, outbuf
);
843 crypto_free_shash(alg
);
846 static void fw_log_firmware_info(const struct firmware
*fw
, const char *name
,
847 struct device
*device
)
852 * Reject firmware file names with ".." path components.
853 * There are drivers that construct firmware file names from device-supplied
854 * strings, and we don't want some device to be able to tell us "I would like to
855 * be sent my firmware from ../../../etc/shadow, please".
857 * Search for ".." surrounded by either '/' or start/end of string.
859 * This intentionally only looks at the firmware name, not at the firmware base
860 * directory or at symlink contents.
862 static bool name_contains_dotdot(const char *name
)
864 size_t name_len
= strlen(name
);
866 return strcmp(name
, "..") == 0 || strncmp(name
, "../", 3) == 0 ||
867 strstr(name
, "/../") != NULL
||
868 (name_len
>= 3 && strcmp(name
+name_len
-3, "/..") == 0);
871 /* called from request_firmware() and request_firmware_work_func() */
873 _request_firmware(const struct firmware
**firmware_p
, const char *name
,
874 struct device
*device
, void *buf
, size_t size
,
875 size_t offset
, u32 opt_flags
)
877 struct firmware
*fw
= NULL
;
878 struct cred
*kern_cred
= NULL
;
879 const struct cred
*old_cred
;
880 bool nondirect
= false;
886 if (!name
|| name
[0] == '\0') {
891 if (name_contains_dotdot(name
)) {
893 "Firmware load for '%s' refused, path contains '..' component\n",
899 ret
= _request_firmware_prepare(&fw
, name
, device
, buf
, size
,
901 if (ret
<= 0) /* error or already assigned */
905 * We are about to try to access the firmware file. Because we may have been
906 * called by a driver when serving an unrelated request from userland, we use
907 * the kernel credentials to read the file.
909 kern_cred
= prepare_kernel_cred(&init_task
);
914 old_cred
= override_creds(kern_cred
);
916 ret
= fw_get_filesystem_firmware(device
, fw
->priv
, "", NULL
);
918 /* Only full reads can support decompression, platform, and sysfs. */
919 if (!(opt_flags
& FW_OPT_PARTIAL
))
922 #ifdef CONFIG_FW_LOADER_COMPRESS_ZSTD
923 if (ret
== -ENOENT
&& nondirect
)
924 ret
= fw_get_filesystem_firmware(device
, fw
->priv
, ".zst",
927 #ifdef CONFIG_FW_LOADER_COMPRESS_XZ
928 if (ret
== -ENOENT
&& nondirect
)
929 ret
= fw_get_filesystem_firmware(device
, fw
->priv
, ".xz",
932 if (ret
== -ENOENT
&& nondirect
)
933 ret
= firmware_fallback_platform(fw
->priv
);
936 if (!(opt_flags
& FW_OPT_NO_WARN
))
938 "Direct firmware load for %s failed with error %d\n",
941 ret
= firmware_fallback_sysfs(fw
, name
, device
,
944 ret
= assign_fw(fw
, device
);
946 revert_creds(old_cred
);
951 fw_abort_batch_reqs(fw
);
952 release_firmware(fw
);
955 fw_log_firmware_info(fw
, name
, device
);
963 * request_firmware() - send firmware request and wait for it
964 * @firmware_p: pointer to firmware image
965 * @name: name of firmware file
966 * @device: device for which firmware is being loaded
968 * @firmware_p will be used to return a firmware image by the name
969 * of @name for device @device.
971 * Should be called from user context where sleeping is allowed.
973 * @name will be used as $FIRMWARE in the uevent environment and
974 * should be distinctive enough not to be confused with any other
975 * firmware image for this or any other device.
976 * It must not contain any ".." path components - "foo/bar..bin" is
977 * allowed, but "foo/../bar.bin" is not.
979 * Caller must hold the reference count of @device.
981 * The function can be called safely inside device's suspend and
985 request_firmware(const struct firmware
**firmware_p
, const char *name
,
986 struct device
*device
)
990 /* Need to pin this module until return */
991 __module_get(THIS_MODULE
);
992 ret
= _request_firmware(firmware_p
, name
, device
, NULL
, 0, 0,
994 module_put(THIS_MODULE
);
997 EXPORT_SYMBOL(request_firmware
);
1000 * firmware_request_nowarn() - request for an optional fw module
1001 * @firmware: pointer to firmware image
1002 * @name: name of firmware file
1003 * @device: device for which firmware is being loaded
1005 * This function is similar in behaviour to request_firmware(), except it
1006 * doesn't produce warning messages when the file is not found. The sysfs
1007 * fallback mechanism is enabled if direct filesystem lookup fails. However,
1008 * failures to find the firmware file with it are still suppressed. It is
1009 * therefore up to the driver to check for the return value of this call and to
1010 * decide when to inform the users of errors.
1012 int firmware_request_nowarn(const struct firmware
**firmware
, const char *name
,
1013 struct device
*device
)
1017 /* Need to pin this module until return */
1018 __module_get(THIS_MODULE
);
1019 ret
= _request_firmware(firmware
, name
, device
, NULL
, 0, 0,
1020 FW_OPT_UEVENT
| FW_OPT_NO_WARN
);
1021 module_put(THIS_MODULE
);
1024 EXPORT_SYMBOL_GPL(firmware_request_nowarn
);
1027 * request_firmware_direct() - load firmware directly without usermode helper
1028 * @firmware_p: pointer to firmware image
1029 * @name: name of firmware file
1030 * @device: device for which firmware is being loaded
1032 * This function works pretty much like request_firmware(), but this doesn't
1033 * fall back to usermode helper even if the firmware couldn't be loaded
1034 * directly from fs. Hence it's useful for loading optional firmwares, which
1035 * aren't always present, without extra long timeouts of udev.
1037 int request_firmware_direct(const struct firmware
**firmware_p
,
1038 const char *name
, struct device
*device
)
1042 __module_get(THIS_MODULE
);
1043 ret
= _request_firmware(firmware_p
, name
, device
, NULL
, 0, 0,
1044 FW_OPT_UEVENT
| FW_OPT_NO_WARN
|
1045 FW_OPT_NOFALLBACK_SYSFS
);
1046 module_put(THIS_MODULE
);
1049 EXPORT_SYMBOL_GPL(request_firmware_direct
);
1052 * firmware_request_platform() - request firmware with platform-fw fallback
1053 * @firmware: pointer to firmware image
1054 * @name: name of firmware file
1055 * @device: device for which firmware is being loaded
1057 * This function is similar in behaviour to request_firmware, except that if
1058 * direct filesystem lookup fails, it will fallback to looking for a copy of the
1059 * requested firmware embedded in the platform's main (e.g. UEFI) firmware.
1061 int firmware_request_platform(const struct firmware
**firmware
,
1062 const char *name
, struct device
*device
)
1066 /* Need to pin this module until return */
1067 __module_get(THIS_MODULE
);
1068 ret
= _request_firmware(firmware
, name
, device
, NULL
, 0, 0,
1069 FW_OPT_UEVENT
| FW_OPT_FALLBACK_PLATFORM
);
1070 module_put(THIS_MODULE
);
1073 EXPORT_SYMBOL_GPL(firmware_request_platform
);
1076 * firmware_request_cache() - cache firmware for suspend so resume can use it
1077 * @device: device for which firmware should be cached for
1078 * @name: name of firmware file
1080 * There are some devices with an optimization that enables the device to not
1081 * require loading firmware on system reboot. This optimization may still
1082 * require the firmware present on resume from suspend. This routine can be
1083 * used to ensure the firmware is present on resume from suspend in these
1084 * situations. This helper is not compatible with drivers which use
1085 * request_firmware_into_buf() or request_firmware_nowait() with no uevent set.
1087 int firmware_request_cache(struct device
*device
, const char *name
)
1091 mutex_lock(&fw_lock
);
1092 ret
= fw_add_devm_name(device
, name
);
1093 mutex_unlock(&fw_lock
);
1097 EXPORT_SYMBOL_GPL(firmware_request_cache
);
1100 * request_firmware_into_buf() - load firmware into a previously allocated buffer
1101 * @firmware_p: pointer to firmware image
1102 * @name: name of firmware file
1103 * @device: device for which firmware is being loaded and DMA region allocated
1104 * @buf: address of buffer to load firmware into
1105 * @size: size of buffer
1107 * This function works pretty much like request_firmware(), but it doesn't
1108 * allocate a buffer to hold the firmware data. Instead, the firmware
1109 * is loaded directly into the buffer pointed to by @buf and the @firmware_p
1110 * data member is pointed at @buf.
1112 * This function doesn't cache firmware either.
1115 request_firmware_into_buf(const struct firmware
**firmware_p
, const char *name
,
1116 struct device
*device
, void *buf
, size_t size
)
1120 if (fw_cache_is_setup(device
, name
))
1123 __module_get(THIS_MODULE
);
1124 ret
= _request_firmware(firmware_p
, name
, device
, buf
, size
, 0,
1125 FW_OPT_UEVENT
| FW_OPT_NOCACHE
);
1126 module_put(THIS_MODULE
);
1129 EXPORT_SYMBOL(request_firmware_into_buf
);
1132 * request_partial_firmware_into_buf() - load partial firmware into a previously allocated buffer
1133 * @firmware_p: pointer to firmware image
1134 * @name: name of firmware file
1135 * @device: device for which firmware is being loaded and DMA region allocated
1136 * @buf: address of buffer to load firmware into
1137 * @size: size of buffer
1138 * @offset: offset into file to read
1140 * This function works pretty much like request_firmware_into_buf except
1141 * it allows a partial read of the file.
1144 request_partial_firmware_into_buf(const struct firmware
**firmware_p
,
1145 const char *name
, struct device
*device
,
1146 void *buf
, size_t size
, size_t offset
)
1150 if (fw_cache_is_setup(device
, name
))
1153 __module_get(THIS_MODULE
);
1154 ret
= _request_firmware(firmware_p
, name
, device
, buf
, size
, offset
,
1155 FW_OPT_UEVENT
| FW_OPT_NOCACHE
|
1157 module_put(THIS_MODULE
);
1160 EXPORT_SYMBOL(request_partial_firmware_into_buf
);
1163 * release_firmware() - release the resource associated with a firmware image
1164 * @fw: firmware resource to release
1166 void release_firmware(const struct firmware
*fw
)
1169 if (!firmware_is_builtin(fw
))
1170 firmware_free_data(fw
);
1174 EXPORT_SYMBOL(release_firmware
);
1177 struct firmware_work
{
1178 struct work_struct work
;
1179 struct module
*module
;
1181 struct device
*device
;
1183 void (*cont
)(const struct firmware
*fw
, void *context
);
1187 static void request_firmware_work_func(struct work_struct
*work
)
1189 struct firmware_work
*fw_work
;
1190 const struct firmware
*fw
;
1192 fw_work
= container_of(work
, struct firmware_work
, work
);
1194 _request_firmware(&fw
, fw_work
->name
, fw_work
->device
, NULL
, 0, 0,
1195 fw_work
->opt_flags
);
1196 fw_work
->cont(fw
, fw_work
->context
);
1197 put_device(fw_work
->device
); /* taken in request_firmware_nowait() */
1199 module_put(fw_work
->module
);
1200 kfree_const(fw_work
->name
);
1205 static int _request_firmware_nowait(
1206 struct module
*module
, bool uevent
,
1207 const char *name
, struct device
*device
, gfp_t gfp
, void *context
,
1208 void (*cont
)(const struct firmware
*fw
, void *context
), bool nowarn
)
1210 struct firmware_work
*fw_work
;
1212 fw_work
= kzalloc(sizeof(struct firmware_work
), gfp
);
1216 fw_work
->module
= module
;
1217 fw_work
->name
= kstrdup_const(name
, gfp
);
1218 if (!fw_work
->name
) {
1222 fw_work
->device
= device
;
1223 fw_work
->context
= context
;
1224 fw_work
->cont
= cont
;
1225 fw_work
->opt_flags
= FW_OPT_NOWAIT
|
1226 (uevent
? FW_OPT_UEVENT
: FW_OPT_USERHELPER
) |
1227 (nowarn
? FW_OPT_NO_WARN
: 0);
1229 if (!uevent
&& fw_cache_is_setup(device
, name
)) {
1230 kfree_const(fw_work
->name
);
1235 if (!try_module_get(module
)) {
1236 kfree_const(fw_work
->name
);
1241 get_device(fw_work
->device
);
1242 INIT_WORK(&fw_work
->work
, request_firmware_work_func
);
1243 schedule_work(&fw_work
->work
);
1248 * request_firmware_nowait() - asynchronous version of request_firmware
1249 * @module: module requesting the firmware
1250 * @uevent: sends uevent to copy the firmware image if this flag
1251 * is non-zero else the firmware copy must be done manually.
1252 * @name: name of firmware file
1253 * @device: device for which firmware is being loaded
1254 * @gfp: allocation flags
1255 * @context: will be passed over to @cont, and
1256 * @fw may be %NULL if firmware request fails.
1257 * @cont: function will be called asynchronously when the firmware
1260 * Caller must hold the reference count of @device.
1262 * Asynchronous variant of request_firmware() for user contexts:
1263 * - sleep for as small periods as possible since it may
1264 * increase kernel boot time of built-in device drivers
1265 * requesting firmware in their ->probe() methods, if
1266 * @gfp is GFP_KERNEL.
1268 * - can't sleep at all if @gfp is GFP_ATOMIC.
1270 int request_firmware_nowait(
1271 struct module
*module
, bool uevent
,
1272 const char *name
, struct device
*device
, gfp_t gfp
, void *context
,
1273 void (*cont
)(const struct firmware
*fw
, void *context
))
1275 return _request_firmware_nowait(module
, uevent
, name
, device
, gfp
,
1276 context
, cont
, false);
1279 EXPORT_SYMBOL(request_firmware_nowait
);
1282 * firmware_request_nowait_nowarn() - async version of request_firmware_nowarn
1283 * @module: module requesting the firmware
1284 * @name: name of firmware file
1285 * @device: device for which firmware is being loaded
1286 * @gfp: allocation flags
1287 * @context: will be passed over to @cont, and
1288 * @fw may be %NULL if firmware request fails.
1289 * @cont: function will be called asynchronously when the firmware
1292 * Similar in function to request_firmware_nowait(), but doesn't print a warning
1293 * when the firmware file could not be found and always sends a uevent to copy
1294 * the firmware image.
1296 int firmware_request_nowait_nowarn(
1297 struct module
*module
, const char *name
,
1298 struct device
*device
, gfp_t gfp
, void *context
,
1299 void (*cont
)(const struct firmware
*fw
, void *context
))
1301 return _request_firmware_nowait(module
, FW_ACTION_UEVENT
, name
, device
,
1302 gfp
, context
, cont
, true);
1304 EXPORT_SYMBOL_GPL(firmware_request_nowait_nowarn
);
1306 #ifdef CONFIG_FW_CACHE
1307 static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain
);
1310 * cache_firmware() - cache one firmware image in kernel memory space
1311 * @fw_name: the firmware image name
1313 * Cache firmware in kernel memory so that drivers can use it when
1314 * system isn't ready for them to request firmware image from userspace.
1315 * Once it returns successfully, driver can use request_firmware or its
1316 * nowait version to get the cached firmware without any interacting
1319 * Return 0 if the firmware image has been cached successfully
1320 * Return !0 otherwise
1323 static int cache_firmware(const char *fw_name
)
1326 const struct firmware
*fw
;
1328 pr_debug("%s: %s\n", __func__
, fw_name
);
1330 ret
= request_firmware(&fw
, fw_name
, NULL
);
1334 pr_debug("%s: %s ret=%d\n", __func__
, fw_name
, ret
);
1339 static struct fw_priv
*lookup_fw_priv(const char *fw_name
)
1341 struct fw_priv
*tmp
;
1342 struct firmware_cache
*fwc
= &fw_cache
;
1344 spin_lock(&fwc
->lock
);
1345 tmp
= __lookup_fw_priv(fw_name
);
1346 spin_unlock(&fwc
->lock
);
1352 * uncache_firmware() - remove one cached firmware image
1353 * @fw_name: the firmware image name
1355 * Uncache one firmware image which has been cached successfully
1358 * Return 0 if the firmware cache has been removed successfully
1359 * Return !0 otherwise
1362 static int uncache_firmware(const char *fw_name
)
1364 struct fw_priv
*fw_priv
;
1367 pr_debug("%s: %s\n", __func__
, fw_name
);
1369 if (firmware_request_builtin(&fw
, fw_name
))
1372 fw_priv
= lookup_fw_priv(fw_name
);
1374 free_fw_priv(fw_priv
);
1381 static struct fw_cache_entry
*alloc_fw_cache_entry(const char *name
)
1383 struct fw_cache_entry
*fce
;
1385 fce
= kzalloc(sizeof(*fce
), GFP_ATOMIC
);
1389 fce
->name
= kstrdup_const(name
, GFP_ATOMIC
);
1399 static int __fw_entry_found(const char *name
)
1401 struct firmware_cache
*fwc
= &fw_cache
;
1402 struct fw_cache_entry
*fce
;
1404 list_for_each_entry(fce
, &fwc
->fw_names
, list
) {
1405 if (!strcmp(fce
->name
, name
))
1411 static void fw_cache_piggyback_on_request(struct fw_priv
*fw_priv
)
1413 const char *name
= fw_priv
->fw_name
;
1414 struct firmware_cache
*fwc
= fw_priv
->fwc
;
1415 struct fw_cache_entry
*fce
;
1417 spin_lock(&fwc
->name_lock
);
1418 if (__fw_entry_found(name
))
1421 fce
= alloc_fw_cache_entry(name
);
1423 list_add(&fce
->list
, &fwc
->fw_names
);
1424 kref_get(&fw_priv
->ref
);
1425 pr_debug("%s: fw: %s\n", __func__
, name
);
1428 spin_unlock(&fwc
->name_lock
);
1431 static void free_fw_cache_entry(struct fw_cache_entry
*fce
)
1433 kfree_const(fce
->name
);
1437 static void __async_dev_cache_fw_image(void *fw_entry
,
1438 async_cookie_t cookie
)
1440 struct fw_cache_entry
*fce
= fw_entry
;
1441 struct firmware_cache
*fwc
= &fw_cache
;
1444 ret
= cache_firmware(fce
->name
);
1446 spin_lock(&fwc
->name_lock
);
1447 list_del(&fce
->list
);
1448 spin_unlock(&fwc
->name_lock
);
1450 free_fw_cache_entry(fce
);
1454 /* called with dev->devres_lock held */
1455 static void dev_create_fw_entry(struct device
*dev
, void *res
,
1458 struct fw_name_devm
*fwn
= res
;
1459 const char *fw_name
= fwn
->name
;
1460 struct list_head
*head
= data
;
1461 struct fw_cache_entry
*fce
;
1463 fce
= alloc_fw_cache_entry(fw_name
);
1465 list_add(&fce
->list
, head
);
1468 static int devm_name_match(struct device
*dev
, void *res
,
1471 struct fw_name_devm
*fwn
= res
;
1472 return (fwn
->magic
== (unsigned long)match_data
);
1475 static void dev_cache_fw_image(struct device
*dev
, void *data
)
1478 struct fw_cache_entry
*fce
;
1479 struct fw_cache_entry
*fce_next
;
1480 struct firmware_cache
*fwc
= &fw_cache
;
1482 devres_for_each_res(dev
, fw_name_devm_release
,
1483 devm_name_match
, &fw_cache
,
1484 dev_create_fw_entry
, &todo
);
1486 list_for_each_entry_safe(fce
, fce_next
, &todo
, list
) {
1487 list_del(&fce
->list
);
1489 spin_lock(&fwc
->name_lock
);
1490 /* only one cache entry for one firmware */
1491 if (!__fw_entry_found(fce
->name
)) {
1492 list_add(&fce
->list
, &fwc
->fw_names
);
1494 free_fw_cache_entry(fce
);
1497 spin_unlock(&fwc
->name_lock
);
1500 async_schedule_domain(__async_dev_cache_fw_image
,
1506 static void __device_uncache_fw_images(void)
1508 struct firmware_cache
*fwc
= &fw_cache
;
1509 struct fw_cache_entry
*fce
;
1511 spin_lock(&fwc
->name_lock
);
1512 while (!list_empty(&fwc
->fw_names
)) {
1513 fce
= list_entry(fwc
->fw_names
.next
,
1514 struct fw_cache_entry
, list
);
1515 list_del(&fce
->list
);
1516 spin_unlock(&fwc
->name_lock
);
1518 uncache_firmware(fce
->name
);
1519 free_fw_cache_entry(fce
);
1521 spin_lock(&fwc
->name_lock
);
1523 spin_unlock(&fwc
->name_lock
);
1527 * device_cache_fw_images() - cache devices' firmware
1529 * If one device called request_firmware or its nowait version
1530 * successfully before, the firmware names are recored into the
1531 * device's devres link list, so device_cache_fw_images can call
1532 * cache_firmware() to cache these firmwares for the device,
1533 * then the device driver can load its firmwares easily at
1534 * time when system is not ready to complete loading firmware.
1536 static void device_cache_fw_images(void)
1538 struct firmware_cache
*fwc
= &fw_cache
;
1541 pr_debug("%s\n", __func__
);
1543 /* cancel uncache work */
1544 cancel_delayed_work_sync(&fwc
->work
);
1546 fw_fallback_set_cache_timeout();
1548 mutex_lock(&fw_lock
);
1549 fwc
->state
= FW_LOADER_START_CACHE
;
1550 dpm_for_each_dev(NULL
, dev_cache_fw_image
);
1551 mutex_unlock(&fw_lock
);
1553 /* wait for completion of caching firmware for all devices */
1554 async_synchronize_full_domain(&fw_cache_domain
);
1556 fw_fallback_set_default_timeout();
1560 * device_uncache_fw_images() - uncache devices' firmware
1562 * uncache all firmwares which have been cached successfully
1563 * by device_uncache_fw_images earlier
1565 static void device_uncache_fw_images(void)
1567 pr_debug("%s\n", __func__
);
1568 __device_uncache_fw_images();
1571 static void device_uncache_fw_images_work(struct work_struct
*work
)
1573 device_uncache_fw_images();
1577 * device_uncache_fw_images_delay() - uncache devices firmwares
1578 * @delay: number of milliseconds to delay uncache device firmwares
1580 * uncache all devices's firmwares which has been cached successfully
1581 * by device_cache_fw_images after @delay milliseconds.
1583 static void device_uncache_fw_images_delay(unsigned long delay
)
1585 queue_delayed_work(system_power_efficient_wq
, &fw_cache
.work
,
1586 msecs_to_jiffies(delay
));
1589 static int fw_pm_notify(struct notifier_block
*notify_block
,
1590 unsigned long mode
, void *unused
)
1593 case PM_HIBERNATION_PREPARE
:
1594 case PM_SUSPEND_PREPARE
:
1595 case PM_RESTORE_PREPARE
:
1597 * Here, kill pending fallback requests will only kill
1598 * non-uevent firmware request to avoid stalling suspend.
1600 kill_pending_fw_fallback_reqs(false);
1601 device_cache_fw_images();
1604 case PM_POST_SUSPEND
:
1605 case PM_POST_HIBERNATION
:
1606 case PM_POST_RESTORE
:
1608 * In case that system sleep failed and syscore_suspend is
1611 mutex_lock(&fw_lock
);
1612 fw_cache
.state
= FW_LOADER_NO_CACHE
;
1613 mutex_unlock(&fw_lock
);
1615 device_uncache_fw_images_delay(10 * MSEC_PER_SEC
);
1622 /* stop caching firmware once syscore_suspend is reached */
1623 static int fw_suspend(void)
1625 fw_cache
.state
= FW_LOADER_NO_CACHE
;
1629 static struct syscore_ops fw_syscore_ops
= {
1630 .suspend
= fw_suspend
,
1633 static int __init
register_fw_pm_ops(void)
1637 spin_lock_init(&fw_cache
.name_lock
);
1638 INIT_LIST_HEAD(&fw_cache
.fw_names
);
1640 INIT_DELAYED_WORK(&fw_cache
.work
,
1641 device_uncache_fw_images_work
);
1643 fw_cache
.pm_notify
.notifier_call
= fw_pm_notify
;
1644 ret
= register_pm_notifier(&fw_cache
.pm_notify
);
1648 register_syscore_ops(&fw_syscore_ops
);
1653 static inline void unregister_fw_pm_ops(void)
1655 unregister_syscore_ops(&fw_syscore_ops
);
1656 unregister_pm_notifier(&fw_cache
.pm_notify
);
1659 static void fw_cache_piggyback_on_request(struct fw_priv
*fw_priv
)
1662 static inline int register_fw_pm_ops(void)
1666 static inline void unregister_fw_pm_ops(void)
1671 static void __init
fw_cache_init(void)
1673 spin_lock_init(&fw_cache
.lock
);
1674 INIT_LIST_HEAD(&fw_cache
.head
);
1675 fw_cache
.state
= FW_LOADER_NO_CACHE
;
1678 static int fw_shutdown_notify(struct notifier_block
*unused1
,
1679 unsigned long unused2
, void *unused3
)
1682 * Kill all pending fallback requests to avoid both stalling shutdown,
1683 * and avoid a deadlock with the usermode_lock.
1685 kill_pending_fw_fallback_reqs(true);
1690 static struct notifier_block fw_shutdown_nb
= {
1691 .notifier_call
= fw_shutdown_notify
,
1694 static int __init
firmware_class_init(void)
1698 /* No need to unfold these on exit */
1701 ret
= register_fw_pm_ops();
1705 ret
= register_reboot_notifier(&fw_shutdown_nb
);
1709 return register_sysfs_loader();
1712 unregister_fw_pm_ops();
1716 static void __exit
firmware_class_exit(void)
1718 unregister_fw_pm_ops();
1719 unregister_reboot_notifier(&fw_shutdown_nb
);
1720 unregister_sysfs_loader();
1723 fs_initcall(firmware_class_init
);
1724 module_exit(firmware_class_exit
);