1/*-
2 * Copyright (c) 2005-2008, Sam Leffler <sam@errno.com>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice unmodified, this list of conditions, and the following
10 *    disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD$");
29
30#include <sys/param.h>
31#include <sys/kernel.h>
32#include <sys/malloc.h>
33#include <sys/queue.h>
34#include <sys/taskqueue.h>
35#include <sys/systm.h>
36#include <sys/lock.h>
37#include <sys/mutex.h>
38#include <sys/errno.h>
39#include <sys/linker.h>
40#include <sys/firmware.h>
41#include <sys/priv.h>
42#include <sys/proc.h>
43#include <sys/module.h>
44#include <sys/eventhandler.h>
45
46#include <sys/filedesc.h>
47#include <sys/vnode.h>
48
49/*
50 * Loadable firmware support. See sys/sys/firmware.h and firmware(9)
51 * form more details on the subsystem.
52 *
53 * 'struct firmware' is the user-visible part of the firmware table.
54 * Additional internal information is stored in a 'struct priv_fw'
55 * (currently a static array). A slot is in use if FW_INUSE is true:
56 */
57
58#define FW_INUSE(p)	((p)->file != NULL || (p)->fw.name != NULL)
59
60/*
61 * fw.name != NULL when an image is registered; file != NULL for
62 * autoloaded images whose handling has not been completed.
63 *
64 * The state of a slot evolves as follows:
65 *	firmware_register	-->  fw.name = image_name
66 *	(autoloaded image)	-->  file = module reference
67 *	firmware_unregister	-->  fw.name = NULL
68 *	(unloadentry complete)	-->  file = NULL
69 *
70 * In order for the above to work, the 'file' field must remain
71 * unchanged in firmware_unregister().
72 *
73 * Images residing in the same module are linked to each other
74 * through the 'parent' argument of firmware_register().
75 * One image (typically, one with the same name as the module to let
76 * the autoloading mechanism work) is considered the parent image for
77 * all other images in the same module. Children affect the refcount
78 * on the parent image preventing improper unloading of the image itself.
79 */
80
81struct priv_fw {
82	int		refcnt;		/* reference count */
83
84	/*
85	 * parent entry, see above. Set on firmware_register(),
86	 * cleared on firmware_unregister().
87	 */
88	struct priv_fw	*parent;
89
90	int 		flags;	/* record FIRMWARE_UNLOAD requests */
91#define FW_UNLOAD	0x100
92
93	/*
94	 * 'file' is private info managed by the autoload/unload code.
95	 * Set at the end of firmware_get(), cleared only in the
96	 * firmware_unload_task, so the latter can depend on its value even
97	 * while the lock is not held.
98	 */
99	linker_file_t   file;	/* module file, if autoloaded */
100
101	/*
102	 * 'fw' is the externally visible image information.
103	 * We do not make it the first field in priv_fw, to avoid the
104	 * temptation of casting pointers to each other.
105	 * Use PRIV_FW(fw) to get a pointer to the cointainer of fw.
106	 * Beware, PRIV_FW does not work for a NULL pointer.
107	 */
108	struct firmware	fw;	/* externally visible information */
109};
110
111/*
112 * PRIV_FW returns the pointer to the container of struct firmware *x.
113 * Cast to intptr_t to override the 'const' attribute of x
114 */
115#define PRIV_FW(x)	((struct priv_fw *)		\
116	((intptr_t)(x) - offsetof(struct priv_fw, fw)) )
117
118/*
119 * At the moment we use a static array as backing store for the registry.
120 * Should we move to a dynamic structure, keep in mind that we cannot
121 * reallocate the array because pointers are held externally.
122 * A list may work, though.
123 */
124#define	FIRMWARE_MAX	50
125static struct priv_fw firmware_table[FIRMWARE_MAX];
126
127/*
128 * Firmware module operations are handled in a separate task as they
129 * might sleep and they require directory context to do i/o.
130 */
131static struct taskqueue *firmware_tq;
132static struct task firmware_unload_task;
133
134/*
135 * This mutex protects accesses to the firmware table.
136 */
137static struct mtx firmware_mtx;
138MTX_SYSINIT(firmware, &firmware_mtx, "firmware table", MTX_DEF);
139
140/*
141 * Helper function to lookup a name.
142 * As a side effect, it sets the pointer to a free slot, if any.
143 * This way we can concentrate most of the registry scanning in
144 * this function, which makes it easier to replace the registry
145 * with some other data structure.
146 */
147static struct priv_fw *
148lookup(const char *name, struct priv_fw **empty_slot)
149{
150	struct priv_fw *fp = NULL;
151	struct priv_fw *dummy;
152	int i;
153
154	if (empty_slot == NULL)
155		empty_slot = &dummy;
156	*empty_slot = NULL;
157	for (i = 0; i < FIRMWARE_MAX; i++) {
158		fp = &firmware_table[i];
159		if (fp->fw.name != NULL && strcasecmp(name, fp->fw.name) == 0)
160			break;
161		else if (!FW_INUSE(fp))
162			*empty_slot = fp;
163	}
164	return (i < FIRMWARE_MAX ) ? fp : NULL;
165}
166
167/*
168 * Register a firmware image with the specified name.  The
169 * image name must not already be registered.  If this is a
170 * subimage then parent refers to a previously registered
171 * image that this should be associated with.
172 */
173const struct firmware *
174firmware_register(const char *imagename, const void *data, size_t datasize,
175    unsigned int version, const struct firmware *parent)
176{
177	struct priv_fw *match, *frp;
178	char *str;
179
180	str = strdup(imagename, M_TEMP);
181
182	mtx_lock(&firmware_mtx);
183	/*
184	 * Do a lookup to make sure the name is unique or find a free slot.
185	 */
186	match = lookup(imagename, &frp);
187	if (match != NULL) {
188		mtx_unlock(&firmware_mtx);
189		printf("%s: image %s already registered!\n",
190			__func__, imagename);
191		free(str, M_TEMP);
192		return NULL;
193	}
194	if (frp == NULL) {
195		mtx_unlock(&firmware_mtx);
196		printf("%s: cannot register image %s, firmware table full!\n",
197		    __func__, imagename);
198		free(str, M_TEMP);
199		return NULL;
200	}
201	bzero(frp, sizeof(*frp));	/* start from a clean record */
202	frp->fw.name = str;
203	frp->fw.data = data;
204	frp->fw.datasize = datasize;
205	frp->fw.version = version;
206	if (parent != NULL)
207		frp->parent = PRIV_FW(parent);
208	mtx_unlock(&firmware_mtx);
209	if (bootverbose)
210		printf("firmware: '%s' version %u: %zu bytes loaded at %p\n",
211		    imagename, version, datasize, data);
212	return &frp->fw;
213}
214
215/*
216 * Unregister/remove a firmware image.  If there are outstanding
217 * references an error is returned and the image is not removed
218 * from the registry.
219 */
220int
221firmware_unregister(const char *imagename)
222{
223	struct priv_fw *fp;
224	int err;
225
226	mtx_lock(&firmware_mtx);
227	fp = lookup(imagename, NULL);
228	if (fp == NULL) {
229		/*
230		 * It is ok for the lookup to fail; this can happen
231		 * when a module is unloaded on last reference and the
232		 * module unload handler unregister's each of it's
233		 * firmware images.
234		 */
235		err = 0;
236	} else if (fp->refcnt != 0) {	/* cannot unregister */
237		err = EBUSY;
238	} else {
239		linker_file_t x = fp->file;	/* save value */
240
241		/*
242		 * Clear the whole entry with bzero to make sure we
243		 * do not forget anything. Then restore 'file' which is
244		 * non-null for autoloaded images.
245		 */
246		free((void *) (uintptr_t) fp->fw.name, M_TEMP);
247		bzero(fp, sizeof(struct priv_fw));
248		fp->file = x;
249		err = 0;
250	}
251	mtx_unlock(&firmware_mtx);
252	return err;
253}
254
255static void
256loadimage(void *arg, int npending)
257{
258	struct thread *td = curthread;
259	char *imagename = arg;
260	struct priv_fw *fp;
261	linker_file_t result;
262	int error;
263
264	/* synchronize with the thread that dispatched us */
265	mtx_lock(&firmware_mtx);
266	mtx_unlock(&firmware_mtx);
267
268	if (td->td_proc->p_fd->fd_rdir == NULL) {
269		printf("%s: root not mounted yet, no way to load image\n",
270		    imagename);
271		goto done;
272	}
273	error = linker_reference_module(imagename, NULL, &result);
274	if (error != 0) {
275		printf("%s: could not load firmware image, error %d\n",
276		    imagename, error);
277		goto done;
278	}
279
280	mtx_lock(&firmware_mtx);
281	fp = lookup(imagename, NULL);
282	if (fp == NULL || fp->file != NULL) {
283		mtx_unlock(&firmware_mtx);
284		if (fp == NULL)
285			printf("%s: firmware image loaded, "
286			    "but did not register\n", imagename);
287		(void) linker_release_module(imagename, NULL, NULL);
288		goto done;
289	}
290	fp->file = result;	/* record the module identity */
291	mtx_unlock(&firmware_mtx);
292done:
293	wakeup_one(imagename);		/* we're done */
294}
295
296/*
297 * Lookup and potentially load the specified firmware image.
298 * If the firmware is not found in the registry, try to load a kernel
299 * module named as the image name.
300 * If the firmware is located, a reference is returned. The caller must
301 * release this reference for the image to be eligible for removal/unload.
302 */
303const struct firmware *
304firmware_get(const char *imagename)
305{
306	struct task fwload_task;
307	struct thread *td;
308	struct priv_fw *fp;
309
310	mtx_lock(&firmware_mtx);
311	fp = lookup(imagename, NULL);
312	if (fp != NULL)
313		goto found;
314	/*
315	 * Image not present, try to load the module holding it.
316	 */
317	td = curthread;
318	if (priv_check(td, PRIV_FIRMWARE_LOAD) != 0 ||
319	    securelevel_gt(td->td_ucred, 0) != 0) {
320		mtx_unlock(&firmware_mtx);
321		printf("%s: insufficient privileges to "
322		    "load firmware image %s\n", __func__, imagename);
323		return NULL;
324	}
325	/*
326	 * Defer load to a thread with known context.  linker_reference_module
327	 * may do filesystem i/o which requires root & current dirs, etc.
328	 * Also we must not hold any mtx's over this call which is problematic.
329	 */
330	if (!cold) {
331		TASK_INIT(&fwload_task, 0, loadimage, __DECONST(void *,
332		    imagename));
333		taskqueue_enqueue(firmware_tq, &fwload_task);
334		msleep(__DECONST(void *, imagename), &firmware_mtx, 0,
335		    "fwload", 0);
336	}
337	/*
338	 * After attempting to load the module, see if the image is registered.
339	 */
340	fp = lookup(imagename, NULL);
341	if (fp == NULL) {
342		mtx_unlock(&firmware_mtx);
343		return NULL;
344	}
345found:				/* common exit point on success */
346	if (fp->refcnt == 0 && fp->parent != NULL)
347		fp->parent->refcnt++;
348	fp->refcnt++;
349	mtx_unlock(&firmware_mtx);
350	return &fp->fw;
351}
352
353/*
354 * Release a reference to a firmware image returned by firmware_get.
355 * The caller may specify, with the FIRMWARE_UNLOAD flag, its desire
356 * to release the resource, but the flag is only advisory.
357 *
358 * If this is the last reference to the firmware image, and this is an
359 * autoloaded module, wake up the firmware_unload_task to figure out
360 * what to do with the associated module.
361 */
362void
363firmware_put(const struct firmware *p, int flags)
364{
365	struct priv_fw *fp = PRIV_FW(p);
366
367	mtx_lock(&firmware_mtx);
368	fp->refcnt--;
369	if (fp->refcnt == 0) {
370		if (fp->parent != NULL)
371			fp->parent->refcnt--;
372		if (flags & FIRMWARE_UNLOAD)
373			fp->flags |= FW_UNLOAD;
374		if (fp->file)
375			taskqueue_enqueue(firmware_tq, &firmware_unload_task);
376	}
377	mtx_unlock(&firmware_mtx);
378}
379
380/*
381 * Setup directory state for the firmware_tq thread so we can do i/o.
382 */
383static void
384set_rootvnode(void *arg, int npending)
385{
386	struct thread *td = curthread;
387	struct proc *p = td->td_proc;
388
389	FILEDESC_XLOCK(p->p_fd);
390	if (p->p_fd->fd_cdir == NULL) {
391		p->p_fd->fd_cdir = rootvnode;
392		VREF(rootvnode);
393	}
394	if (p->p_fd->fd_rdir == NULL) {
395		p->p_fd->fd_rdir = rootvnode;
396		VREF(rootvnode);
397	}
398	FILEDESC_XUNLOCK(p->p_fd);
399
400	free(arg, M_TEMP);
401}
402
403/*
404 * Event handler called on mounting of /; bounce a task
405 * into the task queue thread to setup it's directories.
406 */
407static void
408firmware_mountroot(void *arg)
409{
410	struct task *setroot_task;
411
412	setroot_task = malloc(sizeof(struct task), M_TEMP, M_NOWAIT);
413	if (setroot_task != NULL) {
414		TASK_INIT(setroot_task, 0, set_rootvnode, setroot_task);
415		taskqueue_enqueue(firmware_tq, setroot_task);
416	} else
417		printf("%s: no memory for task!\n", __func__);
418}
419EVENTHANDLER_DEFINE(mountroot, firmware_mountroot, NULL, 0);
420
421/*
422 * The body of the task in charge of unloading autoloaded modules
423 * that are not needed anymore.
424 * Images can be cross-linked so we may need to make multiple passes,
425 * but the time we spend in the loop is bounded because we clear entries
426 * as we touch them.
427 */
428static void
429unloadentry(void *unused1, int unused2)
430{
431	int limit = FIRMWARE_MAX;
432	int i;	/* current cycle */
433
434	mtx_lock(&firmware_mtx);
435	/*
436	 * Scan the table. limit is set to make sure we make another
437	 * full sweep after matching an entry that requires unloading.
438	 */
439	for (i = 0; i < limit; i++) {
440		struct priv_fw *fp;
441		int err;
442
443		fp = &firmware_table[i % FIRMWARE_MAX];
444		if (fp->fw.name == NULL || fp->file == NULL ||
445		    fp->refcnt != 0 || (fp->flags & FW_UNLOAD) == 0)
446			continue;
447
448		/*
449		 * Found an entry. Now:
450		 * 1. bump up limit to make sure we make another full round;
451		 * 2. clear FW_UNLOAD so we don't try this entry again.
452		 * 3. release the lock while trying to unload the module.
453		 * 'file' remains set so that the entry cannot be reused
454		 * in the meantime (it also means that fp->file will
455		 * not change while we release the lock).
456		 */
457		limit = i + FIRMWARE_MAX;	/* make another full round */
458		fp->flags &= ~FW_UNLOAD;	/* do not try again */
459
460		mtx_unlock(&firmware_mtx);
461		err = linker_release_module(NULL, NULL, fp->file);
462		mtx_lock(&firmware_mtx);
463
464		/*
465		 * We rely on the module to call firmware_unregister()
466		 * on unload to actually release the entry.
467		 * If err = 0 we can drop our reference as the system
468		 * accepted it. Otherwise unloading failed (e.g. the
469		 * module itself gave an error) so our reference is
470		 * still valid.
471		 */
472		if (err == 0)
473			fp->file = NULL;
474	}
475	mtx_unlock(&firmware_mtx);
476}
477
478/*
479 * Module glue.
480 */
481static int
482firmware_modevent(module_t mod, int type, void *unused)
483{
484	struct priv_fw *fp;
485	int i, err;
486
487	switch (type) {
488	case MOD_LOAD:
489		TASK_INIT(&firmware_unload_task, 0, unloadentry, NULL);
490		firmware_tq = taskqueue_create("taskqueue_firmware", M_WAITOK,
491		    taskqueue_thread_enqueue, &firmware_tq);
492		/* NB: use our own loop routine that sets up context */
493		(void) taskqueue_start_threads(&firmware_tq, 1, PWAIT,
494		    "firmware taskq");
495		if (rootvnode != NULL) {
496			/*
497			 * Root is already mounted so we won't get an event;
498			 * simulate one here.
499			 */
500			firmware_mountroot(NULL);
501		}
502		return 0;
503
504	case MOD_UNLOAD:
505		/* request all autoloaded modules to be released */
506		mtx_lock(&firmware_mtx);
507		for (i = 0; i < FIRMWARE_MAX; i++) {
508			fp = &firmware_table[i];
509			fp->flags |= FW_UNLOAD;
510		}
511		mtx_unlock(&firmware_mtx);
512		taskqueue_enqueue(firmware_tq, &firmware_unload_task);
513		taskqueue_drain(firmware_tq, &firmware_unload_task);
514		err = 0;
515		for (i = 0; i < FIRMWARE_MAX; i++) {
516			fp = &firmware_table[i];
517			if (fp->fw.name != NULL) {
518				printf("%s: image %p ref %d still active slot %d\n",
519					__func__, fp->fw.name,
520					fp->refcnt,  i);
521				err = EINVAL;
522			}
523		}
524		if (err == 0)
525			taskqueue_free(firmware_tq);
526		return err;
527	}
528	return EINVAL;
529}
530
531static moduledata_t firmware_mod = {
532	"firmware",
533	firmware_modevent,
534	NULL
535};
536DECLARE_MODULE(firmware, firmware_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
537MODULE_VERSION(firmware, 1);
538