29 Nov, 2012

26 commits


27 Nov, 2012

4 commits


16 Nov, 2012

3 commits


15 Nov, 2012

6 commits

  • This patch documents the firmware cache mechanism so that
    users of request_firmware() know that it can be called
    safely inside device's suspend and resume callback, and
    the device's firmware needn't be cached any more by individual
    driver itself to deal with firmware loss during system resume.

    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • This patch introduces one module parameter of 'path' in firmware_class
    to support customizing firmware image search path, so that people can
    use its own firmware path if the default built-in paths can't meet their
    demand[1], and the typical usage is passing the below from kernel command
    parameter when 'firmware_class' is built in kernel:

    firmware_class.path=$CUSTOMIZED_PATH

    [1], https://lkml.org/lkml/2012/10/11/337

    Cc: Linus Torvalds
    Signed-off-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Ming Lei
     
  • The comment above fw_file_size() suggests it is noinline for stack size
    reasons. Use noinline_for_stack to make this more clear.

    Signed-off-by: Cesar Eduardo Barros
    Acked-by: Ming Lei
    Signed-off-by: Greg Kroah-Hartman

    Cesar Eduardo Barros
     
  • There is one race that both request_firmware() with the same
    firmware name.

    The race scenerio is as below:
    CPU1 CPU2
    request_firmware() -->
    _request_firmware_load() return err another request_firmware() is coming -->
    _request_firmware_cleanup is called --> _request_firmware_prepare -->
    release_firmware ---> fw_lookup_and_allocate_buf -->
    spin_lock(&fwc->lock)
    ... __fw_lookup_buf() return true
    fw_free_buf() will be called --> ...
    kref_put -->
    decrease the refcount to 0
    kref_get(&tmp->ref) ==> it will trigger warning
    due to refcount == 0
    __fw_free_buf() -->
    ... spin_unlock(&fwc->lock)
    spin_lock(&fwc->lock)
    list_del(&buf->list)
    spin_unlock(&fwc->lock)
    kfree(buf)
    After that, the freed buf will be used.

    The key race is decreasing refcount to 0 and list_del is not protected together by
    fwc->lock, and it is possible another thread try to get it between refcount==0
    and list_del.

    Fix it here to protect it together.

    Acked-by: Ming Lei
    Signed-off-by: liu chuansheng
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Chuansheng Liu
     
  • There is a race as below when calling request_firmware():
    CPU1 CPU2
    write 0 > loading
    mutex_lock(&fw_lock)
    ...
    set_bit FW_STATUS_DONE class_timeout is coming
    set_bit FW_STATUS_ABORT
    complete_all &completion
    ...
    mutex_unlock(&fw_lock)

    In this time, the bit FW_STATUS_DONE and FW_STATUS_ABORT are set,
    and request_firmware() will return failure due to condition in
    _request_firmware_load():
    if (!buf->size || test_bit(FW_STATUS_ABORT, &buf->status))
    retval = -ENOENT;

    But from the above scenerio, it should be a successful requesting.
    So we need judge if the bit FW_STATUS_DONE is already set before
    calling fw_load_abort() in timeout function.

    As Ming's proposal, we need change the timer into sched_work to
    benefit from using &fw_lock mutex also.

    Signed-off-by: liu chuansheng
    Acked-by: Ming Lei
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Chuansheng Liu
     
  • Greg Kroah-Hartman
     

11 Nov, 2012

1 commit