mtdchar.c 27 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
/*
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
 * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
Linus Torvalds's avatar
Linus Torvalds committed
17 18 19
 *
 */

20 21
#include <linux/device.h>
#include <linux/fs.h>
Andrew Morton's avatar
Andrew Morton committed
22
#include <linux/mm.h>
23
#include <linux/err.h>
24
#include <linux/init.h>
Linus Torvalds's avatar
Linus Torvalds committed
25 26
#include <linux/kernel.h>
#include <linux/module.h>
27 28
#include <linux/slab.h>
#include <linux/sched.h>
29
#include <linux/mutex.h>
30
#include <linux/backing-dev.h>
31
#include <linux/compat.h>
32
#include <linux/mount.h>
33
#include <linux/blkpg.h>
34
#include <linux/magic.h>
35
#include <linux/major.h>
Linus Torvalds's avatar
Linus Torvalds committed
36
#include <linux/mtd/mtd.h>
37
#include <linux/mtd/partitions.h>
38
#include <linux/mtd/map.h>
Linus Torvalds's avatar
Linus Torvalds committed
39

40
#include <asm/uaccess.h>
41

42 43
#include "mtdcore.h"

44
static DEFINE_MUTEX(mtd_mutex);
Linus Torvalds's avatar
Linus Torvalds committed
45

46
/*
47
 * Data structure to hold the pointer to the mtd device as well
Brian Norris's avatar
Brian Norris committed
48
 * as mode information of various use cases.
49
 */
50 51 52 53
struct mtd_file_info {
	struct mtd_info *mtd;
	enum mtd_file_modes mode;
};
54

55
static loff_t mtdchar_lseek(struct file *file, loff_t offset, int orig)
Linus Torvalds's avatar
Linus Torvalds committed
56
{
57
	struct mtd_file_info *mfi = file->private_data;
58
	return fixed_size_llseek(file, offset, orig, mfi->mtd->size);
Linus Torvalds's avatar
Linus Torvalds committed
59 60
}

61
static int mtdchar_open(struct inode *inode, struct file *file)
Linus Torvalds's avatar
Linus Torvalds committed
62 63 64
{
	int minor = iminor(inode);
	int devnum = minor >> 1;
65
	int ret = 0;
Linus Torvalds's avatar
Linus Torvalds committed
66
	struct mtd_info *mtd;
67
	struct mtd_file_info *mfi;
Linus Torvalds's avatar
Linus Torvalds committed
68

69
	pr_debug("MTD_open\n");
Linus Torvalds's avatar
Linus Torvalds committed
70 71

	/* You can't open the RO devices RW */
72
	if ((file->f_mode & FMODE_WRITE) && (minor & 1))
Linus Torvalds's avatar
Linus Torvalds committed
73 74
		return -EACCES;

75
	mutex_lock(&mtd_mutex);
Linus Torvalds's avatar
Linus Torvalds committed
76
	mtd = get_mtd_device(NULL, devnum);
77

78 79 80 81
	if (IS_ERR(mtd)) {
		ret = PTR_ERR(mtd);
		goto out;
	}
82

83
	if (mtd->type == MTD_ABSENT) {
84
		ret = -ENODEV;
85
		goto out1;
Linus Torvalds's avatar
Linus Torvalds committed
86 87 88
	}

	/* You can't open it RW if it's not a writeable device */
89
	if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) {
90
		ret = -EACCES;
91
		goto out1;
Linus Torvalds's avatar
Linus Torvalds committed
92
	}
93

94 95
	mfi = kzalloc(sizeof(*mfi), GFP_KERNEL);
	if (!mfi) {
96
		ret = -ENOMEM;
97
		goto out1;
98 99 100
	}
	mfi->mtd = mtd;
	file->private_data = mfi;
101 102
	mutex_unlock(&mtd_mutex);
	return 0;
103

104 105
out1:
	put_mtd_device(mtd);
106
out:
107
	mutex_unlock(&mtd_mutex);
108
	return ret;
109
} /* mtdchar_open */
Linus Torvalds's avatar
Linus Torvalds committed
110 111 112

/*====================================================================*/

113
static int mtdchar_close(struct inode *inode, struct file *file)
Linus Torvalds's avatar
Linus Torvalds committed
114
{
115 116
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
Linus Torvalds's avatar
Linus Torvalds committed
117

118
	pr_debug("MTD_close\n");
Linus Torvalds's avatar
Linus Torvalds committed
119

120
	/* Only sync if opened RW */
121
	if ((file->f_mode & FMODE_WRITE))
122
		mtd_sync(mtd);
123

Linus Torvalds's avatar
Linus Torvalds committed
124
	put_mtd_device(mtd);
125 126
	file->private_data = NULL;
	kfree(mfi);
Linus Torvalds's avatar
Linus Torvalds committed
127 128

	return 0;
129
} /* mtdchar_close */
Linus Torvalds's avatar
Linus Torvalds committed
130

131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147
/* Back in June 2001, dwmw2 wrote:
 *
 *   FIXME: This _really_ needs to die. In 2.5, we should lock the
 *   userspace buffer down and use it directly with readv/writev.
 *
 * The implementation below, using mtd_kmalloc_up_to, mitigates
 * allocation failures when the system is under low-memory situations
 * or if memory is highly fragmented at the cost of reducing the
 * performance of the requested transfer due to a smaller buffer size.
 *
 * A more complex but more memory-efficient implementation based on
 * get_user_pages and iovecs to cover extents of those pages is a
 * longer-term goal, as intimated by dwmw2 above. However, for the
 * write case, this requires yet more complex head and tail transfer
 * handling when those head and tail offsets and sizes are such that
 * alignment requirements are not met in the NAND subdriver.
 */
Linus Torvalds's avatar
Linus Torvalds committed
148

149 150
static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count,
			loff_t *ppos)
Linus Torvalds's avatar
Linus Torvalds committed
151
{
152 153
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
154
	size_t retlen;
Linus Torvalds's avatar
Linus Torvalds committed
155 156 157
	size_t total_retlen=0;
	int ret=0;
	int len;
158
	size_t size = count;
Linus Torvalds's avatar
Linus Torvalds committed
159
	char *kbuf;
160

161
	pr_debug("MTD_read\n");
Linus Torvalds's avatar
Linus Torvalds committed
162 163 164 165 166 167

	if (*ppos + count > mtd->size)
		count = mtd->size - *ppos;

	if (!count)
		return 0;
168

169
	kbuf = mtd_kmalloc_up_to(mtd, &size);
170 171 172
	if (!kbuf)
		return -ENOMEM;

Linus Torvalds's avatar
Linus Torvalds committed
173
	while (count) {
174
		len = min_t(size_t, count, size);
Linus Torvalds's avatar
Linus Torvalds committed
175

176
		switch (mfi->mode) {
177
		case MTD_FILE_MODE_OTP_FACTORY:
178 179
			ret = mtd_read_fact_prot_reg(mtd, *ppos, len,
						     &retlen, kbuf);
180
			break;
181
		case MTD_FILE_MODE_OTP_USER:
182 183
			ret = mtd_read_user_prot_reg(mtd, *ppos, len,
						     &retlen, kbuf);
184
			break;
185
		case MTD_FILE_MODE_RAW:
186 187 188
		{
			struct mtd_oob_ops ops;

189
			ops.mode = MTD_OPS_RAW;
190 191 192 193
			ops.datbuf = kbuf;
			ops.oobbuf = NULL;
			ops.len = len;

194
			ret = mtd_read_oob(mtd, *ppos, &ops);
195 196 197
			retlen = ops.retlen;
			break;
		}
198
		default:
199
			ret = mtd_read(mtd, *ppos, len, &retlen, kbuf);
200
		}
201
		/* Nand returns -EBADMSG on ECC errors, but it returns
Linus Torvalds's avatar
Linus Torvalds committed
202
		 * the data. For our userspace tools it is important
203
		 * to dump areas with ECC errors!
204
		 * For kernel internal usage it also might return -EUCLEAN
205
		 * to signal the caller that a bitflip has occurred and has
206
		 * been corrected by the ECC algorithm.
Linus Torvalds's avatar
Linus Torvalds committed
207 208 209
		 * Userspace software which accesses NAND this way
		 * must be aware of the fact that it deals with NAND
		 */
210
		if (!ret || mtd_is_bitflip_or_eccerr(ret)) {
Linus Torvalds's avatar
Linus Torvalds committed
211 212
			*ppos += retlen;
			if (copy_to_user(buf, kbuf, retlen)) {
213
				kfree(kbuf);
Linus Torvalds's avatar
Linus Torvalds committed
214 215 216 217 218 219 220
				return -EFAULT;
			}
			else
				total_retlen += retlen;

			count -= retlen;
			buf += retlen;
221 222
			if (retlen == 0)
				count = 0;
Linus Torvalds's avatar
Linus Torvalds committed
223 224 225 226 227
		}
		else {
			kfree(kbuf);
			return ret;
		}
228

Linus Torvalds's avatar
Linus Torvalds committed
229 230
	}

231
	kfree(kbuf);
Linus Torvalds's avatar
Linus Torvalds committed
232
	return total_retlen;
233
} /* mtdchar_read */
Linus Torvalds's avatar
Linus Torvalds committed
234

235 236
static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t count,
			loff_t *ppos)
Linus Torvalds's avatar
Linus Torvalds committed
237
{
238 239
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
240
	size_t size = count;
Linus Torvalds's avatar
Linus Torvalds committed
241 242 243 244 245 246
	char *kbuf;
	size_t retlen;
	size_t total_retlen=0;
	int ret=0;
	int len;

247
	pr_debug("MTD_write\n");
248

Linus Torvalds's avatar
Linus Torvalds committed
249 250
	if (*ppos == mtd->size)
		return -ENOSPC;
251

Linus Torvalds's avatar
Linus Torvalds committed
252 253 254 255 256 257
	if (*ppos + count > mtd->size)
		count = mtd->size - *ppos;

	if (!count)
		return 0;

258
	kbuf = mtd_kmalloc_up_to(mtd, &size);
259 260 261
	if (!kbuf)
		return -ENOMEM;

Linus Torvalds's avatar
Linus Torvalds committed
262
	while (count) {
263
		len = min_t(size_t, count, size);
Linus Torvalds's avatar
Linus Torvalds committed
264 265 266 267 268

		if (copy_from_user(kbuf, buf, len)) {
			kfree(kbuf);
			return -EFAULT;
		}
269

270
		switch (mfi->mode) {
271
		case MTD_FILE_MODE_OTP_FACTORY:
272 273
			ret = -EROFS;
			break;
274
		case MTD_FILE_MODE_OTP_USER:
275 276
			ret = mtd_write_user_prot_reg(mtd, *ppos, len,
						      &retlen, kbuf);
277
			break;
278

279
		case MTD_FILE_MODE_RAW:
280 281 282
		{
			struct mtd_oob_ops ops;

283
			ops.mode = MTD_OPS_RAW;
284 285
			ops.datbuf = kbuf;
			ops.oobbuf = NULL;
286
			ops.ooboffs = 0;
287 288
			ops.len = len;

289
			ret = mtd_write_oob(mtd, *ppos, &ops);
290 291 292 293
			retlen = ops.retlen;
			break;
		}

294
		default:
295
			ret = mtd_write(mtd, *ppos, len, &retlen, kbuf);
296
		}
297 298 299 300 301 302 303 304 305

		/*
		 * Return -ENOSPC only if no data could be written at all.
		 * Otherwise just return the number of bytes that actually
		 * have been written.
		 */
		if ((ret == -ENOSPC) && (total_retlen))
			break;

Linus Torvalds's avatar
Linus Torvalds committed
306 307 308 309 310 311 312 313 314 315 316 317
		if (!ret) {
			*ppos += retlen;
			total_retlen += retlen;
			count -= retlen;
			buf += retlen;
		}
		else {
			kfree(kbuf);
			return ret;
		}
	}

318
	kfree(kbuf);
Linus Torvalds's avatar
Linus Torvalds committed
319
	return total_retlen;
320
} /* mtdchar_write */
Linus Torvalds's avatar
Linus Torvalds committed
321 322 323 324 325 326 327 328 329 330 331

/*======================================================================

    IOCTL calls for getting device parameters.

======================================================================*/
static void mtdchar_erase_callback (struct erase_info *instr)
{
	wake_up((wait_queue_head_t *)instr->priv);
}

332 333 334
static int otp_select_filemode(struct mtd_file_info *mfi, int mode)
{
	struct mtd_info *mtd = mfi->mtd;
335 336
	size_t retlen;

337 338
	switch (mode) {
	case MTD_OTP_FACTORY:
339 340 341 342
		if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) ==
				-EOPNOTSUPP)
			return -EOPNOTSUPP;

343
		mfi->mode = MTD_FILE_MODE_OTP_FACTORY;
344 345
		break;
	case MTD_OTP_USER:
346 347 348 349
		if (mtd_read_user_prot_reg(mtd, -1, 0, &retlen, NULL) ==
				-EOPNOTSUPP)
			return -EOPNOTSUPP;

350
		mfi->mode = MTD_FILE_MODE_OTP_USER;
351 352
		break;
	case MTD_OTP_OFF:
353
		mfi->mode = MTD_FILE_MODE_NORMAL;
354
		break;
355 356
	default:
		return -EINVAL;
357
	}
358 359

	return 0;
360 361
}

362
static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
363 364 365
	uint64_t start, uint32_t length, void __user *ptr,
	uint32_t __user *retp)
{
366
	struct mtd_file_info *mfi = file->private_data;
367 368 369 370 371 372 373 374 375 376
	struct mtd_oob_ops ops;
	uint32_t retlen;
	int ret = 0;

	if (!(file->f_mode & FMODE_WRITE))
		return -EPERM;

	if (length > 4096)
		return -EINVAL;

377
	if (!mtd->_write_oob)
378 379
		ret = -EOPNOTSUPP;
	else
380
		ret = access_ok(VERIFY_READ, ptr, length) ? 0 : -EFAULT;
381 382 383 384 385

	if (ret)
		return ret;

	ops.ooblen = length;
386
	ops.ooboffs = start & (mtd->writesize - 1);
387
	ops.datbuf = NULL;
388
	ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW :
389
		MTD_OPS_PLACE_OOB;
390 391 392 393

	if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
		return -EINVAL;

394 395 396
	ops.oobbuf = memdup_user(ptr, length);
	if (IS_ERR(ops.oobbuf))
		return PTR_ERR(ops.oobbuf);
397

398
	start &= ~((uint64_t)mtd->writesize - 1);
399
	ret = mtd_write_oob(mtd, start, &ops);
400 401 402 403 404 405 406 407 408 409 410

	if (ops.oobretlen > 0xFFFFFFFFU)
		ret = -EOVERFLOW;
	retlen = ops.oobretlen;
	if (copy_to_user(retp, &retlen, sizeof(length)))
		ret = -EFAULT;

	kfree(ops.oobbuf);
	return ret;
}

411
static int mtdchar_readoob(struct file *file, struct mtd_info *mtd,
412 413
	uint64_t start, uint32_t length, void __user *ptr,
	uint32_t __user *retp)
414
{
415
	struct mtd_file_info *mfi = file->private_data;
416 417 418 419 420 421
	struct mtd_oob_ops ops;
	int ret = 0;

	if (length > 4096)
		return -EINVAL;

422 423
	if (!access_ok(VERIFY_WRITE, ptr, length))
		return -EFAULT;
424 425

	ops.ooblen = length;
426
	ops.ooboffs = start & (mtd->writesize - 1);
427
	ops.datbuf = NULL;
428
	ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW :
429
		MTD_OPS_PLACE_OOB;
430 431 432 433 434 435 436 437

	if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
		return -EINVAL;

	ops.oobbuf = kmalloc(length, GFP_KERNEL);
	if (!ops.oobbuf)
		return -ENOMEM;

438
	start &= ~((uint64_t)mtd->writesize - 1);
439
	ret = mtd_read_oob(mtd, start, &ops);
440 441 442 443 444 445 446 447

	if (put_user(ops.oobretlen, retp))
		ret = -EFAULT;
	else if (ops.oobretlen && copy_to_user(ptr, ops.oobbuf,
					    ops.oobretlen))
		ret = -EFAULT;

	kfree(ops.oobbuf);
448 449 450 451 452 453 454 455 456

	/*
	 * NAND returns -EBADMSG on ECC errors, but it returns the OOB
	 * data. For our userspace tools it is important to dump areas
	 * with ECC errors!
	 * For kernel internal usage it also might return -EUCLEAN
	 * to signal the caller that a bitflip has occured and has
	 * been corrected by the ECC algorithm.
	 *
457 458 459
	 * Note: currently the standard NAND function, nand_read_oob_std,
	 * does not calculate ECC for the OOB area, so do not rely on
	 * this behavior unless you have replaced it with your own.
460
	 */
461
	if (mtd_is_bitflip_or_eccerr(ret))
462 463
		return 0;

464 465 466
	return ret;
}

467
/*
468 469 470 471 472 473
 * Copies (and truncates, if necessary) OOB layout information to the
 * deprecated layout struct, nand_ecclayout_user. This is necessary only to
 * support the deprecated API ioctl ECCGETLAYOUT while allowing all new
 * functionality to use mtd_ooblayout_ops flexibly (i.e. mtd_ooblayout_ops
 * can describe any kind of OOB layout with almost zero overhead from a
 * memory usage point of view).
474
 */
475 476
static int shrink_ecclayout(struct mtd_info *mtd,
			    struct nand_ecclayout_user *to)
477
{
478 479
	struct mtd_oob_region oobregion;
	int i, section = 0, ret;
480

481
	if (!mtd || !to)
482 483 484 485
		return -EINVAL;

	memset(to, 0, sizeof(*to));

486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504
	to->eccbytes = 0;
	for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) {
		u32 eccpos;

		ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
		if (ret < 0) {
			if (ret != -ERANGE)
				return ret;

			break;
		}

		eccpos = oobregion.offset;
		for (; i < MTD_MAX_ECCPOS_ENTRIES &&
		       eccpos < oobregion.offset + oobregion.length; i++) {
			to->eccpos[i] = eccpos++;
			to->eccbytes++;
		}
	}
505 506

	for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES; i++) {
507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541
		ret = mtd_ooblayout_free(mtd, i, &oobregion);
		if (ret < 0) {
			if (ret != -ERANGE)
				return ret;

			break;
		}

		to->oobfree[i].offset = oobregion.offset;
		to->oobfree[i].length = oobregion.length;
		to->oobavail += to->oobfree[i].length;
	}

	return 0;
}

static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to)
{
	struct mtd_oob_region oobregion;
	int i, section = 0, ret;

	if (!mtd || !to)
		return -EINVAL;

	memset(to, 0, sizeof(*to));

	to->eccbytes = 0;
	for (i = 0; i < ARRAY_SIZE(to->eccpos);) {
		u32 eccpos;

		ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
		if (ret < 0) {
			if (ret != -ERANGE)
				return ret;

542
			break;
543 544 545 546 547 548 549 550 551 552
		}

		if (oobregion.length + i > ARRAY_SIZE(to->eccpos))
			return -EINVAL;

		eccpos = oobregion.offset;
		for (; eccpos < oobregion.offset + oobregion.length; i++) {
			to->eccpos[i] = eccpos++;
			to->eccbytes++;
		}
553 554
	}

555 556 557 558 559 560 561 562 563 564 565 566 567 568 569
	for (i = 0; i < 8; i++) {
		ret = mtd_ooblayout_free(mtd, i, &oobregion);
		if (ret < 0) {
			if (ret != -ERANGE)
				return ret;

			break;
		}

		to->oobfree[i][0] = oobregion.offset;
		to->oobfree[i][1] = oobregion.length;
	}

	to->useecc = MTD_NANDECC_AUTOPLACE;

570 571 572
	return 0;
}

573
static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
574
			       struct blkpg_ioctl_arg *arg)
575 576 577 578 579 580
{
	struct blkpg_partition p;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

581
	if (copy_from_user(&p, arg->data, sizeof(p)))
582 583
		return -EFAULT;

584
	switch (arg->op) {
585 586
	case BLKPG_ADD_PARTITION:

587 588 589 590
		/* Only master mtd device must be used to add partitions */
		if (mtd_is_partition(mtd))
			return -EINVAL;

591 592 593
		/* Sanitize user input */
		p.devname[BLKPG_DEVNAMELTH - 1] = '\0';

594 595 596 597 598 599 600 601 602 603 604 605 606 607
		return mtd_add_partition(mtd, p.devname, p.start, p.length);

	case BLKPG_DEL_PARTITION:

		if (p.pno < 0)
			return -EINVAL;

		return mtd_del_partition(mtd, p.pno);

	default:
		return -EINVAL;
	}
}

608
static int mtdchar_write_ioctl(struct mtd_info *mtd,
Brian Norris's avatar
Brian Norris committed
609 610 611 612
		struct mtd_write_req __user *argp)
{
	struct mtd_write_req req;
	struct mtd_oob_ops ops;
613
	const void __user *usr_data, *usr_oob;
Brian Norris's avatar
Brian Norris committed
614 615
	int ret;

616
	if (copy_from_user(&req, argp, sizeof(req)))
Brian Norris's avatar
Brian Norris committed
617
		return -EFAULT;
618 619 620 621 622 623 624

	usr_data = (const void __user *)(uintptr_t)req.usr_data;
	usr_oob = (const void __user *)(uintptr_t)req.usr_oob;
	if (!access_ok(VERIFY_READ, usr_data, req.len) ||
	    !access_ok(VERIFY_READ, usr_oob, req.ooblen))
		return -EFAULT;

625
	if (!mtd->_write_oob)
Brian Norris's avatar
Brian Norris committed
626 627 628 629 630 631 632
		return -EOPNOTSUPP;

	ops.mode = req.mode;
	ops.len = (size_t)req.len;
	ops.ooblen = (size_t)req.ooblen;
	ops.ooboffs = 0;

633
	if (usr_data) {
Brian Norris's avatar
Brian Norris committed
634 635 636 637 638 639 640
		ops.datbuf = memdup_user(usr_data, ops.len);
		if (IS_ERR(ops.datbuf))
			return PTR_ERR(ops.datbuf);
	} else {
		ops.datbuf = NULL;
	}

641
	if (usr_oob) {
Brian Norris's avatar
Brian Norris committed
642 643 644 645 646 647 648 649 650
		ops.oobbuf = memdup_user(usr_oob, ops.ooblen);
		if (IS_ERR(ops.oobbuf)) {
			kfree(ops.datbuf);
			return PTR_ERR(ops.oobbuf);
		}
	} else {
		ops.oobbuf = NULL;
	}

651
	ret = mtd_write_oob(mtd, (loff_t)req.start, &ops);
Brian Norris's avatar
Brian Norris committed
652 653 654 655 656 657 658

	kfree(ops.datbuf);
	kfree(ops.oobbuf);

	return ret;
}

659
static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
Linus Torvalds's avatar
Linus Torvalds committed
660
{
661 662
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
Linus Torvalds's avatar
Linus Torvalds committed
663 664 665
	void __user *argp = (void __user *)arg;
	int ret = 0;
	u_long size;
666
	struct mtd_info_user info;
667

668
	pr_debug("MTD_ioctl\n");
Linus Torvalds's avatar
Linus Torvalds committed
669 670 671 672 673 674 675 676 677 678

	size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
	if (cmd & IOC_IN) {
		if (!access_ok(VERIFY_READ, argp, size))
			return -EFAULT;
	}
	if (cmd & IOC_OUT) {
		if (!access_ok(VERIFY_WRITE, argp, size))
			return -EFAULT;
	}
679

Linus Torvalds's avatar
Linus Torvalds committed
680 681 682 683 684 685 686 687
	switch (cmd) {
	case MEMGETREGIONCOUNT:
		if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))
			return -EFAULT;
		break;

	case MEMGETREGIONINFO:
	{
688 689
		uint32_t ur_idx;
		struct mtd_erase_region_info *kr;
690
		struct region_info_user __user *ur = argp;
Linus Torvalds's avatar
Linus Torvalds committed
691

692
		if (get_user(ur_idx, &(ur->regionindex)))
Linus Torvalds's avatar
Linus Torvalds committed
693 694
			return -EFAULT;

695 696 697
		if (ur_idx >= mtd->numeraseregions)
			return -EINVAL;

698 699 700 701 702
		kr = &(mtd->eraseregions[ur_idx]);

		if (put_user(kr->offset, &(ur->offset))
		    || put_user(kr->erasesize, &(ur->erasesize))
		    || put_user(kr->numblocks, &(ur->numblocks)))
Linus Torvalds's avatar
Linus Torvalds committed
703
			return -EFAULT;
704

Linus Torvalds's avatar
Linus Torvalds committed
705 706 707 708
		break;
	}

	case MEMGETINFO:
709
		memset(&info, 0, sizeof(info));
710 711 712 713 714 715
		info.type	= mtd->type;
		info.flags	= mtd->flags;
		info.size	= mtd->size;
		info.erasesize	= mtd->erasesize;
		info.writesize	= mtd->writesize;
		info.oobsize	= mtd->oobsize;
716 717
		/* The below field is obsolete */
		info.padding	= 0;
718
		if (copy_to_user(argp, &info, sizeof(struct mtd_info_user)))
Linus Torvalds's avatar
Linus Torvalds committed
719 720 721 722
			return -EFAULT;
		break;

	case MEMERASE:
723
	case MEMERASE64:
Linus Torvalds's avatar
Linus Torvalds committed
724 725 726
	{
		struct erase_info *erase;

727
		if(!(file->f_mode & FMODE_WRITE))
Linus Torvalds's avatar
Linus Torvalds committed
728 729
			return -EPERM;

730
		erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
731 732 733 734 735 736 737 738
		if (!erase)
			ret = -ENOMEM;
		else {
			wait_queue_head_t waitq;
			DECLARE_WAITQUEUE(wait, current);

			init_waitqueue_head(&waitq);

739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758
			if (cmd == MEMERASE64) {
				struct erase_info_user64 einfo64;

				if (copy_from_user(&einfo64, argp,
					    sizeof(struct erase_info_user64))) {
					kfree(erase);
					return -EFAULT;
				}
				erase->addr = einfo64.start;
				erase->len = einfo64.length;
			} else {
				struct erase_info_user einfo32;

				if (copy_from_user(&einfo32, argp,
					    sizeof(struct erase_info_user))) {
					kfree(erase);
					return -EFAULT;
				}
				erase->addr = einfo32.start;
				erase->len = einfo32.length;
Linus Torvalds's avatar
Linus Torvalds committed
759 760 761 762
			}
			erase->mtd = mtd;
			erase->callback = mtdchar_erase_callback;
			erase->priv = (unsigned long)&waitq;
763

Linus Torvalds's avatar
Linus Torvalds committed
764 765 766
			/*
			  FIXME: Allow INTERRUPTIBLE. Which means
			  not having the wait_queue head on the stack.
767

Linus Torvalds's avatar
Linus Torvalds committed
768 769 770 771 772
			  If the wq_head is on the stack, and we
			  leave because we got interrupted, then the
			  wq_head is no longer there when the
			  callback routine tries to wake us up.
			*/
773
			ret = mtd_erase(mtd, erase);
Linus Torvalds's avatar
Linus Torvalds committed
774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792
			if (!ret) {
				set_current_state(TASK_UNINTERRUPTIBLE);
				add_wait_queue(&waitq, &wait);
				if (erase->state != MTD_ERASE_DONE &&
				    erase->state != MTD_ERASE_FAILED)
					schedule();
				remove_wait_queue(&waitq, &wait);
				set_current_state(TASK_RUNNING);

				ret = (erase->state == MTD_ERASE_FAILED)?-EIO:0;
			}
			kfree(erase);
		}
		break;
	}

	case MEMWRITEOOB:
	{
		struct mtd_oob_buf buf;
793
		struct mtd_oob_buf __user *buf_user = argp;
Linus Torvalds's avatar
Linus Torvalds committed
794

795 796
		/* NOTE: writes return length to buf_user->length */
		if (copy_from_user(&buf, argp, sizeof(buf)))
Linus Torvalds's avatar
Linus Torvalds committed
797
			ret = -EFAULT;
798
		else
799
			ret = mtdchar_writeoob(file, mtd, buf.start, buf.length,
800
				buf.ptr, &buf_user->length);
Linus Torvalds's avatar
Linus Torvalds committed
801 802 803 804 805 806
		break;
	}

	case MEMREADOOB:
	{
		struct mtd_oob_buf buf;
807
		struct mtd_oob_buf __user *buf_user = argp;
808

809 810
		/* NOTE: writes return length to buf_user->start */
		if (copy_from_user(&buf, argp, sizeof(buf)))
Linus Torvalds's avatar
Linus Torvalds committed
811
			ret = -EFAULT;
812
		else
813
			ret = mtdchar_readoob(file, mtd, buf.start, buf.length,
814
				buf.ptr, &buf_user->start);
Linus Torvalds's avatar
Linus Torvalds committed
815 816 817
		break;
	}

818 819 820 821 822 823 824 825
	case MEMWRITEOOB64:
	{
		struct mtd_oob_buf64 buf;
		struct mtd_oob_buf64 __user *buf_user = argp;

		if (copy_from_user(&buf, argp, sizeof(buf)))
			ret = -EFAULT;
		else
826
			ret = mtdchar_writeoob(file, mtd, buf.start, buf.length,
827 828 829 830 831 832 833 834 835 836 837 838 839
				(void __user *)(uintptr_t)buf.usr_ptr,
				&buf_user->length);
		break;
	}

	case MEMREADOOB64:
	{
		struct mtd_oob_buf64 buf;
		struct mtd_oob_buf64 __user *buf_user = argp;

		if (copy_from_user(&buf, argp, sizeof(buf)))
			ret = -EFAULT;
		else
840
			ret = mtdchar_readoob(file, mtd, buf.start, buf.length,
841 842 843 844 845
				(void __user *)(uintptr_t)buf.usr_ptr,
				&buf_user->length);
		break;
	}

Brian Norris's avatar
Brian Norris committed
846 847
	case MEMWRITE:
	{
848
		ret = mtdchar_write_ioctl(mtd,
Brian Norris's avatar
Brian Norris committed
849 850 851 852
		      (struct mtd_write_req __user *)arg);
		break;
	}

Linus Torvalds's avatar
Linus Torvalds committed
853 854
	case MEMLOCK:
	{
855
		struct erase_info_user einfo;
Linus Torvalds's avatar
Linus Torvalds committed
856

857
		if (copy_from_user(&einfo, argp, sizeof(einfo)))
Linus Torvalds's avatar
Linus Torvalds committed
858 859
			return -EFAULT;

860
		ret = mtd_lock(mtd, einfo.start, einfo.length);
Linus Torvalds's avatar
Linus Torvalds committed
861 862 863 864 865
		break;
	}

	case MEMUNLOCK:
	{
866
		struct erase_info_user einfo;
Linus Torvalds's avatar
Linus Torvalds committed
867

868
		if (copy_from_user(&einfo, argp, sizeof(einfo)))
Linus Torvalds's avatar
Linus Torvalds committed
869 870
			return -EFAULT;

871
		ret = mtd_unlock(mtd, einfo.start, einfo.length);
Linus Torvalds's avatar
Linus Torvalds committed
872 873 874
		break;
	}

875 876 877 878 879 880 881
	case MEMISLOCKED:
	{
		struct erase_info_user einfo;

		if (copy_from_user(&einfo, argp, sizeof(einfo)))
			return -EFAULT;

882
		ret = mtd_is_locked(mtd, einfo.start, einfo.length);
883 884 885
		break;
	}

886
	/* Legacy interface */
Linus Torvalds's avatar
Linus Torvalds committed
887 888
	case MEMGETOOBSEL:
	{
889 890
		struct nand_oobinfo oi;

891
		if (!mtd->ooblayout)
892 893
			return -EOPNOTSUPP;

894 895 896
		ret = get_oobinfo(mtd, &oi);
		if (ret)
			return ret;
897 898

		if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo)))
Linus Torvalds's avatar
Linus Torvalds committed
899 900 901 902 903 904 905
			return -EFAULT;
		break;
	}

	case MEMGETBADBLOCK:
	{
		loff_t offs;
906

Linus Torvalds's avatar
Linus Torvalds committed
907 908
		if (copy_from_user(&offs, argp, sizeof(loff_t)))
			return -EFAULT;
909
		return mtd_block_isbad(mtd, offs);
Linus Torvalds's avatar
Linus Torvalds committed
910 911 912 913 914 915 916 917 918
		break;
	}

	case MEMSETBADBLOCK:
	{
		loff_t offs;

		if (copy_from_user(&offs, argp, sizeof(loff_t)))
			return -EFAULT;
919
		return mtd_block_markbad(mtd, offs);
Linus Torvalds's avatar
Linus Torvalds committed
920 921 922
		break;
	}

923 924 925 926 927
	case OTPSELECT:
	{
		int mode;
		if (copy_from_user(&mode, argp, sizeof(int)))
			return -EFAULT;
928

929
		mfi->mode = MTD_FILE_MODE_NORMAL;
930 931 932

		ret = otp_select_filemode(mfi, mode);

933
		file->f_pos = 0;
934 935 936 937 938 939 940
		break;
	}

	case OTPGETREGIONCOUNT:
	case OTPGETREGIONINFO:
	{
		struct otp_info *buf = kmalloc(4096, GFP_KERNEL);
941
		size_t retlen;
942 943
		if (!buf)
			return -ENOMEM;
944
		switch (mfi->mode) {
945
		case MTD_FILE_MODE_OTP_FACTORY:
946
			ret = mtd_get_fact_prot_info(mtd, 4096, &retlen, buf);
947
			break;
948
		case MTD_FILE_MODE_OTP_USER:
949
			ret = mtd_get_user_prot_info(mtd, 4096, &retlen, buf);
950
			break;
951
		default:
952
			ret = -EINVAL;
953
			break;
954
		}
955
		if (!ret) {
956
			if (cmd == OTPGETREGIONCOUNT) {
957
				int nbr = retlen / sizeof(struct otp_info);
958 959
				ret = copy_to_user(argp, &nbr, sizeof(int));
			} else
960
				ret = copy_to_user(argp, buf, retlen);
961 962 963 964 965 966 967 968 969
			if (ret)
				ret = -EFAULT;
		}
		kfree(buf);
		break;
	}

	case OTPLOCK:
	{
970
		struct otp_info oinfo;
971

972
		if (mfi->mode != MTD_FILE_MODE_OTP_USER)
973
			return -EINVAL;
974
		if (copy_from_user(&oinfo, argp, sizeof(oinfo)))
975
			return -EFAULT;
976
		ret = mtd_lock_user_prot_reg(mtd, oinfo.start, oinfo.length);
977 978 979
		break;
	}

980
	/* This ioctl is being deprecated - it truncates the ECC layout */
981 982
	case ECCGETLAYOUT:
	{
983 984
		struct nand_ecclayout_user *usrlay;

985
		if (!mtd->ooblayout)
986 987
			return -EOPNOTSUPP;

988 989 990 991
		usrlay = kmalloc(sizeof(*usrlay), GFP_KERNEL);
		if (!usrlay)
			return -ENOMEM;

992
		shrink_ecclayout(mtd, usrlay);
993 994 995 996

		if (copy_to_user(argp, usrlay, sizeof(*usrlay)))
			ret = -EFAULT;
		kfree(usrlay);
997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012
		break;
	}

	case ECCGETSTATS:
	{
		if (copy_to_user(argp, &mtd->ecc_stats,
				 sizeof(struct mtd_ecc_stats)))
			return -EFAULT;
		break;
	}

	case MTDFILEMODE:
	{
		mfi->mode = 0;

		switch(arg) {
1013 1014
		case MTD_FILE_MODE_OTP_FACTORY:
		case MTD_FILE_MODE_OTP_USER:
1015 1016 1017
			ret = otp_select_filemode(mfi, arg);
			break;

1018
		case MTD_FILE_MODE_RAW:
1019
			if (!mtd_has_oob(mtd))
1020 1021 1022
				return -EOPNOTSUPP;
			mfi->mode = arg;

1023
		case MTD_FILE_MODE_NORMAL:
1024 1025 1026 1027 1028 1029 1030 1031
			break;
		default:
			ret = -EINVAL;
		}
		file->f_pos = 0;
		break;
	}

1032 1033
	case BLKPG:
	{
1034 1035 1036 1037 1038 1039 1040
		struct blkpg_ioctl_arg __user *blk_arg = argp;
		struct blkpg_ioctl_arg a;

		if (copy_from_user(&a, blk_arg, sizeof(a)))
			ret = -EFAULT;
		else
			ret = mtdchar_blkpg_ioctl(mtd, &a);
1041 1042 1043 1044 1045 1046 1047 1048 1049 1050
		break;
	}

	case BLKRRPART:
	{
		/* No reread partition feature. Just return ok */
		ret = 0;
		break;
	}

Linus Torvalds's avatar
Linus Torvalds committed
1051 1052 1053 1054 1055 1056 1057
	default:
		ret = -ENOTTY;
	}

	return ret;
} /* memory_ioctl */

1058
static long mtdchar_unlocked_ioctl(struct file *file, u_int cmd, u_long arg)
1059 1060 1061
{
	int ret;

1062
	mutex_lock(&mtd_mutex);
1063
	ret = mtdchar_ioctl(file, cmd, arg);
1064
	mutex_unlock(&mtd_mutex);
1065 1066 1067 1068

	return ret;
}

1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079
#ifdef CONFIG_COMPAT

struct mtd_oob_buf32 {
	u_int32_t start;
	u_int32_t length;
	compat_caddr_t ptr;	/* unsigned char* */
};

#define MEMWRITEOOB32		_IOWR('M', 3, struct mtd_oob_buf32)
#define MEMREADOOB32		_IOWR('M', 4, struct mtd_oob_buf32)

1080
static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd,
1081 1082 1083 1084
	unsigned long arg)
{
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
1085
	void __user *argp = compat_ptr(arg);
1086 1087
	int ret = 0;

1088
	mutex_lock(&mtd_mutex);
1089 1090 1091 1092 1093 1094 1095 1096 1097 1098

	switch (cmd) {
	case MEMWRITEOOB32:
	{
		struct mtd_oob_buf32 buf;
		struct mtd_oob_buf32 __user *buf_user = argp;

		if (copy_from_user(&buf, argp, sizeof(buf)))
			ret = -EFAULT;
		else
1099
			ret = mtdchar_writeoob(file, mtd, buf.start,
1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113
				buf.length, compat_ptr(buf.ptr),
				&buf_user->length);
		break;
	}

	case MEMREADOOB32:
	{
		struct mtd_oob_buf32 buf;
		struct mtd_oob_buf32 __user *buf_user = argp;

		/* NOTE: writes return length to buf->start */
		if (copy_from_user(&buf, argp, sizeof(buf)))
			ret = -EFAULT;
		else
1114
			ret = mtdchar_readoob(file, mtd, buf.start,
1115 1116 1117 1118
				buf.length, compat_ptr(buf.ptr),
				&buf_user->start);
		break;
	}
1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141

	case BLKPG:
	{
		/* Convert from blkpg_compat_ioctl_arg to blkpg_ioctl_arg */
		struct blkpg_compat_ioctl_arg __user *uarg = argp;
		struct blkpg_compat_ioctl_arg compat_arg;
		struct blkpg_ioctl_arg a;

		if (copy_from_user(&compat_arg, uarg, sizeof(compat_arg))) {
			ret = -EFAULT;
			break;
		}

		memset(&a, 0, sizeof(a));
		a.op = compat_arg.op;
		a.flags = compat_arg.flags;
		a.datalen = compat_arg.datalen;
		a.data = compat_ptr(compat_arg.data);

		ret = mtdchar_blkpg_ioctl(mtd, &a);
		break;
	}

1142
	default:
1143
		ret = mtdchar_ioctl(file, cmd, (unsigned long)argp);
1144 1145
	}

1146
	mutex_unlock(&mtd_mutex);
1147 1148 1149 1150 1151 1152

	return ret;
}

#endif /* CONFIG_COMPAT */

1153 1154 1155 1156 1157 1158
/*
 * try to determine where a shared mapping can be made
 * - only supported for NOMMU at the moment (MMU can't doesn't copy private
 *   mappings)
 */
#ifndef CONFIG_MMU
1159
static unsigned long mtdchar_get_unmapped_area(struct file *file,
1160 1161 1162 1163 1164 1165 1166
					   unsigned long addr,
					   unsigned long len,
					   unsigned long pgoff,
					   unsigned long flags)
{
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
1167 1168
	unsigned long offset;
	int ret;
1169

1170 1171
	if (addr != 0)
		return (unsigned long) -EINVAL;
1172

1173 1174
	if (len > mtd->size || pgoff >= (mtd->size >> PAGE_SHIFT))
		return (unsigned long) -EINVAL;
1175

1176 1177 1178
	offset = pgoff << PAGE_SHIFT;
	if (offset > mtd->size - len)
		return (unsigned long) -EINVAL;
1179

1180
	ret = mtd_get_unmapped_area(mtd, len, offset, flags);
1181
	return ret == -EOPNOTSUPP ? -ENODEV : ret;
1182
}
1183 1184 1185 1186 1187 1188 1189

static unsigned mtdchar_mmap_capabilities(struct file *file)
{
	struct mtd_file_info *mfi = file->private_data;

	return mtd_mmap_capabilities(mfi->mtd);
}
1190 1191 1192 1193 1194
#endif

/*
 * set up a mapping for shared memory segments
 */
1195
static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
1196 1197 1198 1199
{
#ifdef CONFIG_MMU
	struct mtd_file_info *mfi = file->private_data;
	struct mtd_info *mtd = mfi->mtd;
1200 1201
	struct map_info *map = mtd->priv;

1202 1203 1204 1205 1206
        /* This is broken because it assumes the MTD device is map-based
	   and that mtd->priv is a valid struct map_info.  It should be
	   replaced with something that uses the mtd_get_unmapped_area()
	   operation properly. */
	if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
1207
#ifdef pgprot_noncached
1208
		if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory))
1209 1210
			vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
#endif
1211
		return vm_iomap_memory(vma, map->phys, map->size);
1212
	}
1213
	return -ENODEV;
1214
#else
1215
	return vma->vm_flags & VM_SHARED ? 0 : -EACCES;
1216 1217 1218
#endif
}

1219
static const struct file_operations mtd_fops = {
Linus Torvalds's avatar
Linus Torvalds committed
1220
	.owner		= THIS_MODULE,
1221 1222 1223 1224
	.llseek		= mtdchar_lseek,
	.read		= mtdchar_read,
	.write		= mtdchar_write,
	.unlocked_ioctl	= mtdchar_unlocked_ioctl,
1225
#ifdef CONFIG_COMPAT
1226
	.compat_ioctl	= mtdchar_compat_ioctl,
1227
#endif
1228 1229 1230
	.open		= mtdchar_open,
	.release	= mtdchar_close,
	.mmap		= mtdchar_mmap,
1231
#ifndef CONFIG_MMU
1232
	.get_unmapped_area = mtdchar_get_unmapped_area,
1233
	.mmap_capabilities = mtdchar_mmap_capabilities,
1234
#endif
Linus Torvalds's avatar
Linus Torvalds committed
1235 1236
};

1237
int __init init_mtdchar(void)
Linus Torvalds's avatar
Linus Torvalds committed
1238
{
1239
	int ret;
1240

1241
	ret = __register_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS,
1242
				   "mtd", &mtd_fops);
1243
	if (ret < 0) {
1244 1245
		pr_err("Can't allocate major number %d for MTD\n",
		       MTD_CHAR_MAJOR);
1246
		return ret;
1247 1248
	}

1249
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
1250 1251
}

1252
void __exit cleanup_mtdchar(void)
Linus Torvalds's avatar
Linus Torvalds committed
1253
{
1254
	__unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd");
Linus Torvalds's avatar
Linus Torvalds committed
1255 1256
}

1257
MODULE_ALIAS_CHARDEV_MAJOR(MTD_CHAR_MAJOR);