1 /* 2 * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 17 * 18 */ 19 20 #include <linux/device.h> 21 #include <linux/fs.h> 22 #include <linux/mm.h> 23 #include <linux/err.h> 24 #include <linux/init.h> 25 #include <linux/kernel.h> 26 #include <linux/module.h> 27 #include <linux/slab.h> 28 #include <linux/sched.h> 29 #include <linux/mutex.h> 30 #include <linux/backing-dev.h> 31 #include <linux/compat.h> 32 #include <linux/mount.h> 33 #include <linux/blkpg.h> 34 #include <linux/magic.h> 35 #include <linux/major.h> 36 #include <linux/mtd/mtd.h> 37 #include <linux/mtd/partitions.h> 38 #include <linux/mtd/map.h> 39 40 #include <asm/uaccess.h> 41 42 #include "mtdcore.h" 43 44 static DEFINE_MUTEX(mtd_mutex); 45 46 /* 47 * Data structure to hold the pointer to the mtd device as well 48 * as mode information of various use cases. 49 */ 50 struct mtd_file_info { 51 struct mtd_info *mtd; 52 struct inode *ino; 53 enum mtd_file_modes mode; 54 }; 55 56 static loff_t mtdchar_lseek(struct file *file, loff_t offset, int orig) 57 { 58 struct mtd_file_info *mfi = file->private_data; 59 return fixed_size_llseek(file, offset, orig, mfi->mtd->size); 60 } 61 62 static int count; 63 static struct vfsmount *mnt; 64 static struct file_system_type mtd_inodefs_type; 65 66 static int mtdchar_open(struct inode *inode, struct file *file) 67 { 68 int minor = iminor(inode); 69 int devnum = minor >> 1; 70 int ret = 0; 71 struct mtd_info *mtd; 72 struct mtd_file_info *mfi; 73 struct inode *mtd_ino; 74 75 pr_debug("MTD_open\n"); 76 77 /* You can't open the RO devices RW */ 78 if ((file->f_mode & FMODE_WRITE) && (minor & 1)) 79 return -EACCES; 80 81 ret = simple_pin_fs(&mtd_inodefs_type, &mnt, &count); 82 if (ret) 83 return ret; 84 85 mutex_lock(&mtd_mutex); 86 mtd = get_mtd_device(NULL, devnum); 87 88 if (IS_ERR(mtd)) { 89 ret = PTR_ERR(mtd); 90 goto out; 91 } 92 93 if (mtd->type == MTD_ABSENT) { 94 ret = -ENODEV; 95 goto out1; 96 } 97 98 mtd_ino = iget_locked(mnt->mnt_sb, devnum); 99 if (!mtd_ino) { 100 ret = -ENOMEM; 101 goto out1; 102 } 103 if (mtd_ino->i_state & I_NEW) { 104 mtd_ino->i_private = mtd; 105 mtd_ino->i_mode = S_IFCHR; 106 mtd_ino->i_data.backing_dev_info = mtd->backing_dev_info; 107 unlock_new_inode(mtd_ino); 108 } 109 file->f_mapping = mtd_ino->i_mapping; 110 111 /* You can't open it RW if it's not a writeable device */ 112 if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) { 113 ret = -EACCES; 114 goto out2; 115 } 116 117 mfi = kzalloc(sizeof(*mfi), GFP_KERNEL); 118 if (!mfi) { 119 ret = -ENOMEM; 120 goto out2; 121 } 122 mfi->ino = mtd_ino; 123 mfi->mtd = mtd; 124 file->private_data = mfi; 125 mutex_unlock(&mtd_mutex); 126 return 0; 127 128 out2: 129 iput(mtd_ino); 130 out1: 131 put_mtd_device(mtd); 132 out: 133 mutex_unlock(&mtd_mutex); 134 simple_release_fs(&mnt, &count); 135 return ret; 136 } /* mtdchar_open */ 137 138 /*====================================================================*/ 139 140 static int mtdchar_close(struct inode *inode, struct file *file) 141 { 142 struct mtd_file_info *mfi = file->private_data; 143 struct mtd_info *mtd = mfi->mtd; 144 145 pr_debug("MTD_close\n"); 146 147 /* Only sync if opened RW */ 148 if ((file->f_mode & FMODE_WRITE)) 149 mtd_sync(mtd); 150 151 iput(mfi->ino); 152 153 put_mtd_device(mtd); 154 file->private_data = NULL; 155 kfree(mfi); 156 simple_release_fs(&mnt, &count); 157 158 return 0; 159 } /* mtdchar_close */ 160 161 /* Back in June 2001, dwmw2 wrote: 162 * 163 * FIXME: This _really_ needs to die. In 2.5, we should lock the 164 * userspace buffer down and use it directly with readv/writev. 165 * 166 * The implementation below, using mtd_kmalloc_up_to, mitigates 167 * allocation failures when the system is under low-memory situations 168 * or if memory is highly fragmented at the cost of reducing the 169 * performance of the requested transfer due to a smaller buffer size. 170 * 171 * A more complex but more memory-efficient implementation based on 172 * get_user_pages and iovecs to cover extents of those pages is a 173 * longer-term goal, as intimated by dwmw2 above. However, for the 174 * write case, this requires yet more complex head and tail transfer 175 * handling when those head and tail offsets and sizes are such that 176 * alignment requirements are not met in the NAND subdriver. 177 */ 178 179 static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, 180 loff_t *ppos) 181 { 182 struct mtd_file_info *mfi = file->private_data; 183 struct mtd_info *mtd = mfi->mtd; 184 size_t retlen; 185 size_t total_retlen=0; 186 int ret=0; 187 int len; 188 size_t size = count; 189 char *kbuf; 190 191 pr_debug("MTD_read\n"); 192 193 if (*ppos + count > mtd->size) 194 count = mtd->size - *ppos; 195 196 if (!count) 197 return 0; 198 199 kbuf = mtd_kmalloc_up_to(mtd, &size); 200 if (!kbuf) 201 return -ENOMEM; 202 203 while (count) { 204 len = min_t(size_t, count, size); 205 206 switch (mfi->mode) { 207 case MTD_FILE_MODE_OTP_FACTORY: 208 ret = mtd_read_fact_prot_reg(mtd, *ppos, len, 209 &retlen, kbuf); 210 break; 211 case MTD_FILE_MODE_OTP_USER: 212 ret = mtd_read_user_prot_reg(mtd, *ppos, len, 213 &retlen, kbuf); 214 break; 215 case MTD_FILE_MODE_RAW: 216 { 217 struct mtd_oob_ops ops; 218 219 ops.mode = MTD_OPS_RAW; 220 ops.datbuf = kbuf; 221 ops.oobbuf = NULL; 222 ops.len = len; 223 224 ret = mtd_read_oob(mtd, *ppos, &ops); 225 retlen = ops.retlen; 226 break; 227 } 228 default: 229 ret = mtd_read(mtd, *ppos, len, &retlen, kbuf); 230 } 231 /* Nand returns -EBADMSG on ECC errors, but it returns 232 * the data. For our userspace tools it is important 233 * to dump areas with ECC errors! 234 * For kernel internal usage it also might return -EUCLEAN 235 * to signal the caller that a bitflip has occurred and has 236 * been corrected by the ECC algorithm. 237 * Userspace software which accesses NAND this way 238 * must be aware of the fact that it deals with NAND 239 */ 240 if (!ret || mtd_is_bitflip_or_eccerr(ret)) { 241 *ppos += retlen; 242 if (copy_to_user(buf, kbuf, retlen)) { 243 kfree(kbuf); 244 return -EFAULT; 245 } 246 else 247 total_retlen += retlen; 248 249 count -= retlen; 250 buf += retlen; 251 if (retlen == 0) 252 count = 0; 253 } 254 else { 255 kfree(kbuf); 256 return ret; 257 } 258 259 } 260 261 kfree(kbuf); 262 return total_retlen; 263 } /* mtdchar_read */ 264 265 static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t count, 266 loff_t *ppos) 267 { 268 struct mtd_file_info *mfi = file->private_data; 269 struct mtd_info *mtd = mfi->mtd; 270 size_t size = count; 271 char *kbuf; 272 size_t retlen; 273 size_t total_retlen=0; 274 int ret=0; 275 int len; 276 277 pr_debug("MTD_write\n"); 278 279 if (*ppos == mtd->size) 280 return -ENOSPC; 281 282 if (*ppos + count > mtd->size) 283 count = mtd->size - *ppos; 284 285 if (!count) 286 return 0; 287 288 kbuf = mtd_kmalloc_up_to(mtd, &size); 289 if (!kbuf) 290 return -ENOMEM; 291 292 while (count) { 293 len = min_t(size_t, count, size); 294 295 if (copy_from_user(kbuf, buf, len)) { 296 kfree(kbuf); 297 return -EFAULT; 298 } 299 300 switch (mfi->mode) { 301 case MTD_FILE_MODE_OTP_FACTORY: 302 ret = -EROFS; 303 break; 304 case MTD_FILE_MODE_OTP_USER: 305 ret = mtd_write_user_prot_reg(mtd, *ppos, len, 306 &retlen, kbuf); 307 break; 308 309 case MTD_FILE_MODE_RAW: 310 { 311 struct mtd_oob_ops ops; 312 313 ops.mode = MTD_OPS_RAW; 314 ops.datbuf = kbuf; 315 ops.oobbuf = NULL; 316 ops.ooboffs = 0; 317 ops.len = len; 318 319 ret = mtd_write_oob(mtd, *ppos, &ops); 320 retlen = ops.retlen; 321 break; 322 } 323 324 default: 325 ret = mtd_write(mtd, *ppos, len, &retlen, kbuf); 326 } 327 328 /* 329 * Return -ENOSPC only if no data could be written at all. 330 * Otherwise just return the number of bytes that actually 331 * have been written. 332 */ 333 if ((ret == -ENOSPC) && (total_retlen)) 334 break; 335 336 if (!ret) { 337 *ppos += retlen; 338 total_retlen += retlen; 339 count -= retlen; 340 buf += retlen; 341 } 342 else { 343 kfree(kbuf); 344 return ret; 345 } 346 } 347 348 kfree(kbuf); 349 return total_retlen; 350 } /* mtdchar_write */ 351 352 /*====================================================================== 353 354 IOCTL calls for getting device parameters. 355 356 ======================================================================*/ 357 static void mtdchar_erase_callback (struct erase_info *instr) 358 { 359 wake_up((wait_queue_head_t *)instr->priv); 360 } 361 362 static int otp_select_filemode(struct mtd_file_info *mfi, int mode) 363 { 364 struct mtd_info *mtd = mfi->mtd; 365 size_t retlen; 366 367 switch (mode) { 368 case MTD_OTP_FACTORY: 369 if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == 370 -EOPNOTSUPP) 371 return -EOPNOTSUPP; 372 373 mfi->mode = MTD_FILE_MODE_OTP_FACTORY; 374 break; 375 case MTD_OTP_USER: 376 if (mtd_read_user_prot_reg(mtd, -1, 0, &retlen, NULL) == 377 -EOPNOTSUPP) 378 return -EOPNOTSUPP; 379 380 mfi->mode = MTD_FILE_MODE_OTP_USER; 381 break; 382 case MTD_OTP_OFF: 383 mfi->mode = MTD_FILE_MODE_NORMAL; 384 break; 385 default: 386 return -EINVAL; 387 } 388 389 return 0; 390 } 391 392 static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd, 393 uint64_t start, uint32_t length, void __user *ptr, 394 uint32_t __user *retp) 395 { 396 struct mtd_file_info *mfi = file->private_data; 397 struct mtd_oob_ops ops; 398 uint32_t retlen; 399 int ret = 0; 400 401 if (!(file->f_mode & FMODE_WRITE)) 402 return -EPERM; 403 404 if (length > 4096) 405 return -EINVAL; 406 407 if (!mtd->_write_oob) 408 ret = -EOPNOTSUPP; 409 else 410 ret = access_ok(VERIFY_READ, ptr, length) ? 0 : -EFAULT; 411 412 if (ret) 413 return ret; 414 415 ops.ooblen = length; 416 ops.ooboffs = start & (mtd->writesize - 1); 417 ops.datbuf = NULL; 418 ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW : 419 MTD_OPS_PLACE_OOB; 420 421 if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs)) 422 return -EINVAL; 423 424 ops.oobbuf = memdup_user(ptr, length); 425 if (IS_ERR(ops.oobbuf)) 426 return PTR_ERR(ops.oobbuf); 427 428 start &= ~((uint64_t)mtd->writesize - 1); 429 ret = mtd_write_oob(mtd, start, &ops); 430 431 if (ops.oobretlen > 0xFFFFFFFFU) 432 ret = -EOVERFLOW; 433 retlen = ops.oobretlen; 434 if (copy_to_user(retp, &retlen, sizeof(length))) 435 ret = -EFAULT; 436 437 kfree(ops.oobbuf); 438 return ret; 439 } 440 441 static int mtdchar_readoob(struct file *file, struct mtd_info *mtd, 442 uint64_t start, uint32_t length, void __user *ptr, 443 uint32_t __user *retp) 444 { 445 struct mtd_file_info *mfi = file->private_data; 446 struct mtd_oob_ops ops; 447 int ret = 0; 448 449 if (length > 4096) 450 return -EINVAL; 451 452 if (!access_ok(VERIFY_WRITE, ptr, length)) 453 return -EFAULT; 454 455 ops.ooblen = length; 456 ops.ooboffs = start & (mtd->writesize - 1); 457 ops.datbuf = NULL; 458 ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW : 459 MTD_OPS_PLACE_OOB; 460 461 if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs)) 462 return -EINVAL; 463 464 ops.oobbuf = kmalloc(length, GFP_KERNEL); 465 if (!ops.oobbuf) 466 return -ENOMEM; 467 468 start &= ~((uint64_t)mtd->writesize - 1); 469 ret = mtd_read_oob(mtd, start, &ops); 470 471 if (put_user(ops.oobretlen, retp)) 472 ret = -EFAULT; 473 else if (ops.oobretlen && copy_to_user(ptr, ops.oobbuf, 474 ops.oobretlen)) 475 ret = -EFAULT; 476 477 kfree(ops.oobbuf); 478 479 /* 480 * NAND returns -EBADMSG on ECC errors, but it returns the OOB 481 * data. For our userspace tools it is important to dump areas 482 * with ECC errors! 483 * For kernel internal usage it also might return -EUCLEAN 484 * to signal the caller that a bitflip has occured and has 485 * been corrected by the ECC algorithm. 486 * 487 * Note: currently the standard NAND function, nand_read_oob_std, 488 * does not calculate ECC for the OOB area, so do not rely on 489 * this behavior unless you have replaced it with your own. 490 */ 491 if (mtd_is_bitflip_or_eccerr(ret)) 492 return 0; 493 494 return ret; 495 } 496 497 /* 498 * Copies (and truncates, if necessary) data from the larger struct, 499 * nand_ecclayout, to the smaller, deprecated layout struct, 500 * nand_ecclayout_user. This is necessary only to support the deprecated 501 * API ioctl ECCGETLAYOUT while allowing all new functionality to use 502 * nand_ecclayout flexibly (i.e. the struct may change size in new 503 * releases without requiring major rewrites). 504 */ 505 static int shrink_ecclayout(const struct nand_ecclayout *from, 506 struct nand_ecclayout_user *to) 507 { 508 int i; 509 510 if (!from || !to) 511 return -EINVAL; 512 513 memset(to, 0, sizeof(*to)); 514 515 to->eccbytes = min((int)from->eccbytes, MTD_MAX_ECCPOS_ENTRIES); 516 for (i = 0; i < to->eccbytes; i++) 517 to->eccpos[i] = from->eccpos[i]; 518 519 for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES; i++) { 520 if (from->oobfree[i].length == 0 && 521 from->oobfree[i].offset == 0) 522 break; 523 to->oobavail += from->oobfree[i].length; 524 to->oobfree[i] = from->oobfree[i]; 525 } 526 527 return 0; 528 } 529 530 static int mtdchar_blkpg_ioctl(struct mtd_info *mtd, 531 struct blkpg_ioctl_arg __user *arg) 532 { 533 struct blkpg_ioctl_arg a; 534 struct blkpg_partition p; 535 536 if (!capable(CAP_SYS_ADMIN)) 537 return -EPERM; 538 539 if (copy_from_user(&a, arg, sizeof(struct blkpg_ioctl_arg))) 540 return -EFAULT; 541 542 if (copy_from_user(&p, a.data, sizeof(struct blkpg_partition))) 543 return -EFAULT; 544 545 switch (a.op) { 546 case BLKPG_ADD_PARTITION: 547 548 /* Only master mtd device must be used to add partitions */ 549 if (mtd_is_partition(mtd)) 550 return -EINVAL; 551 552 return mtd_add_partition(mtd, p.devname, p.start, p.length); 553 554 case BLKPG_DEL_PARTITION: 555 556 if (p.pno < 0) 557 return -EINVAL; 558 559 return mtd_del_partition(mtd, p.pno); 560 561 default: 562 return -EINVAL; 563 } 564 } 565 566 static int mtdchar_write_ioctl(struct mtd_info *mtd, 567 struct mtd_write_req __user *argp) 568 { 569 struct mtd_write_req req; 570 struct mtd_oob_ops ops; 571 const void __user *usr_data, *usr_oob; 572 int ret; 573 574 if (copy_from_user(&req, argp, sizeof(req))) 575 return -EFAULT; 576 577 usr_data = (const void __user *)(uintptr_t)req.usr_data; 578 usr_oob = (const void __user *)(uintptr_t)req.usr_oob; 579 if (!access_ok(VERIFY_READ, usr_data, req.len) || 580 !access_ok(VERIFY_READ, usr_oob, req.ooblen)) 581 return -EFAULT; 582 583 if (!mtd->_write_oob) 584 return -EOPNOTSUPP; 585 586 ops.mode = req.mode; 587 ops.len = (size_t)req.len; 588 ops.ooblen = (size_t)req.ooblen; 589 ops.ooboffs = 0; 590 591 if (usr_data) { 592 ops.datbuf = memdup_user(usr_data, ops.len); 593 if (IS_ERR(ops.datbuf)) 594 return PTR_ERR(ops.datbuf); 595 } else { 596 ops.datbuf = NULL; 597 } 598 599 if (usr_oob) { 600 ops.oobbuf = memdup_user(usr_oob, ops.ooblen); 601 if (IS_ERR(ops.oobbuf)) { 602 kfree(ops.datbuf); 603 return PTR_ERR(ops.oobbuf); 604 } 605 } else { 606 ops.oobbuf = NULL; 607 } 608 609 ret = mtd_write_oob(mtd, (loff_t)req.start, &ops); 610 611 kfree(ops.datbuf); 612 kfree(ops.oobbuf); 613 614 return ret; 615 } 616 617 static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) 618 { 619 struct mtd_file_info *mfi = file->private_data; 620 struct mtd_info *mtd = mfi->mtd; 621 void __user *argp = (void __user *)arg; 622 int ret = 0; 623 u_long size; 624 struct mtd_info_user info; 625 626 pr_debug("MTD_ioctl\n"); 627 628 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT; 629 if (cmd & IOC_IN) { 630 if (!access_ok(VERIFY_READ, argp, size)) 631 return -EFAULT; 632 } 633 if (cmd & IOC_OUT) { 634 if (!access_ok(VERIFY_WRITE, argp, size)) 635 return -EFAULT; 636 } 637 638 switch (cmd) { 639 case MEMGETREGIONCOUNT: 640 if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int))) 641 return -EFAULT; 642 break; 643 644 case MEMGETREGIONINFO: 645 { 646 uint32_t ur_idx; 647 struct mtd_erase_region_info *kr; 648 struct region_info_user __user *ur = argp; 649 650 if (get_user(ur_idx, &(ur->regionindex))) 651 return -EFAULT; 652 653 if (ur_idx >= mtd->numeraseregions) 654 return -EINVAL; 655 656 kr = &(mtd->eraseregions[ur_idx]); 657 658 if (put_user(kr->offset, &(ur->offset)) 659 || put_user(kr->erasesize, &(ur->erasesize)) 660 || put_user(kr->numblocks, &(ur->numblocks))) 661 return -EFAULT; 662 663 break; 664 } 665 666 case MEMGETINFO: 667 memset(&info, 0, sizeof(info)); 668 info.type = mtd->type; 669 info.flags = mtd->flags; 670 info.size = mtd->size; 671 info.erasesize = mtd->erasesize; 672 info.writesize = mtd->writesize; 673 info.oobsize = mtd->oobsize; 674 /* The below field is obsolete */ 675 info.padding = 0; 676 if (copy_to_user(argp, &info, sizeof(struct mtd_info_user))) 677 return -EFAULT; 678 break; 679 680 case MEMERASE: 681 case MEMERASE64: 682 { 683 struct erase_info *erase; 684 685 if(!(file->f_mode & FMODE_WRITE)) 686 return -EPERM; 687 688 erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL); 689 if (!erase) 690 ret = -ENOMEM; 691 else { 692 wait_queue_head_t waitq; 693 DECLARE_WAITQUEUE(wait, current); 694 695 init_waitqueue_head(&waitq); 696 697 if (cmd == MEMERASE64) { 698 struct erase_info_user64 einfo64; 699 700 if (copy_from_user(&einfo64, argp, 701 sizeof(struct erase_info_user64))) { 702 kfree(erase); 703 return -EFAULT; 704 } 705 erase->addr = einfo64.start; 706 erase->len = einfo64.length; 707 } else { 708 struct erase_info_user einfo32; 709 710 if (copy_from_user(&einfo32, argp, 711 sizeof(struct erase_info_user))) { 712 kfree(erase); 713 return -EFAULT; 714 } 715 erase->addr = einfo32.start; 716 erase->len = einfo32.length; 717 } 718 erase->mtd = mtd; 719 erase->callback = mtdchar_erase_callback; 720 erase->priv = (unsigned long)&waitq; 721 722 /* 723 FIXME: Allow INTERRUPTIBLE. Which means 724 not having the wait_queue head on the stack. 725 726 If the wq_head is on the stack, and we 727 leave because we got interrupted, then the 728 wq_head is no longer there when the 729 callback routine tries to wake us up. 730 */ 731 ret = mtd_erase(mtd, erase); 732 if (!ret) { 733 set_current_state(TASK_UNINTERRUPTIBLE); 734 add_wait_queue(&waitq, &wait); 735 if (erase->state != MTD_ERASE_DONE && 736 erase->state != MTD_ERASE_FAILED) 737 schedule(); 738 remove_wait_queue(&waitq, &wait); 739 set_current_state(TASK_RUNNING); 740 741 ret = (erase->state == MTD_ERASE_FAILED)?-EIO:0; 742 } 743 kfree(erase); 744 } 745 break; 746 } 747 748 case MEMWRITEOOB: 749 { 750 struct mtd_oob_buf buf; 751 struct mtd_oob_buf __user *buf_user = argp; 752 753 /* NOTE: writes return length to buf_user->length */ 754 if (copy_from_user(&buf, argp, sizeof(buf))) 755 ret = -EFAULT; 756 else 757 ret = mtdchar_writeoob(file, mtd, buf.start, buf.length, 758 buf.ptr, &buf_user->length); 759 break; 760 } 761 762 case MEMREADOOB: 763 { 764 struct mtd_oob_buf buf; 765 struct mtd_oob_buf __user *buf_user = argp; 766 767 /* NOTE: writes return length to buf_user->start */ 768 if (copy_from_user(&buf, argp, sizeof(buf))) 769 ret = -EFAULT; 770 else 771 ret = mtdchar_readoob(file, mtd, buf.start, buf.length, 772 buf.ptr, &buf_user->start); 773 break; 774 } 775 776 case MEMWRITEOOB64: 777 { 778 struct mtd_oob_buf64 buf; 779 struct mtd_oob_buf64 __user *buf_user = argp; 780 781 if (copy_from_user(&buf, argp, sizeof(buf))) 782 ret = -EFAULT; 783 else 784 ret = mtdchar_writeoob(file, mtd, buf.start, buf.length, 785 (void __user *)(uintptr_t)buf.usr_ptr, 786 &buf_user->length); 787 break; 788 } 789 790 case MEMREADOOB64: 791 { 792 struct mtd_oob_buf64 buf; 793 struct mtd_oob_buf64 __user *buf_user = argp; 794 795 if (copy_from_user(&buf, argp, sizeof(buf))) 796 ret = -EFAULT; 797 else 798 ret = mtdchar_readoob(file, mtd, buf.start, buf.length, 799 (void __user *)(uintptr_t)buf.usr_ptr, 800 &buf_user->length); 801 break; 802 } 803 804 case MEMWRITE: 805 { 806 ret = mtdchar_write_ioctl(mtd, 807 (struct mtd_write_req __user *)arg); 808 break; 809 } 810 811 case MEMLOCK: 812 { 813 struct erase_info_user einfo; 814 815 if (copy_from_user(&einfo, argp, sizeof(einfo))) 816 return -EFAULT; 817 818 ret = mtd_lock(mtd, einfo.start, einfo.length); 819 break; 820 } 821 822 case MEMUNLOCK: 823 { 824 struct erase_info_user einfo; 825 826 if (copy_from_user(&einfo, argp, sizeof(einfo))) 827 return -EFAULT; 828 829 ret = mtd_unlock(mtd, einfo.start, einfo.length); 830 break; 831 } 832 833 case MEMISLOCKED: 834 { 835 struct erase_info_user einfo; 836 837 if (copy_from_user(&einfo, argp, sizeof(einfo))) 838 return -EFAULT; 839 840 ret = mtd_is_locked(mtd, einfo.start, einfo.length); 841 break; 842 } 843 844 /* Legacy interface */ 845 case MEMGETOOBSEL: 846 { 847 struct nand_oobinfo oi; 848 849 if (!mtd->ecclayout) 850 return -EOPNOTSUPP; 851 if (mtd->ecclayout->eccbytes > ARRAY_SIZE(oi.eccpos)) 852 return -EINVAL; 853 854 oi.useecc = MTD_NANDECC_AUTOPLACE; 855 memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos)); 856 memcpy(&oi.oobfree, mtd->ecclayout->oobfree, 857 sizeof(oi.oobfree)); 858 oi.eccbytes = mtd->ecclayout->eccbytes; 859 860 if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo))) 861 return -EFAULT; 862 break; 863 } 864 865 case MEMGETBADBLOCK: 866 { 867 loff_t offs; 868 869 if (copy_from_user(&offs, argp, sizeof(loff_t))) 870 return -EFAULT; 871 return mtd_block_isbad(mtd, offs); 872 break; 873 } 874 875 case MEMSETBADBLOCK: 876 { 877 loff_t offs; 878 879 if (copy_from_user(&offs, argp, sizeof(loff_t))) 880 return -EFAULT; 881 return mtd_block_markbad(mtd, offs); 882 break; 883 } 884 885 case OTPSELECT: 886 { 887 int mode; 888 if (copy_from_user(&mode, argp, sizeof(int))) 889 return -EFAULT; 890 891 mfi->mode = MTD_FILE_MODE_NORMAL; 892 893 ret = otp_select_filemode(mfi, mode); 894 895 file->f_pos = 0; 896 break; 897 } 898 899 case OTPGETREGIONCOUNT: 900 case OTPGETREGIONINFO: 901 { 902 struct otp_info *buf = kmalloc(4096, GFP_KERNEL); 903 size_t retlen; 904 if (!buf) 905 return -ENOMEM; 906 switch (mfi->mode) { 907 case MTD_FILE_MODE_OTP_FACTORY: 908 ret = mtd_get_fact_prot_info(mtd, 4096, &retlen, buf); 909 break; 910 case MTD_FILE_MODE_OTP_USER: 911 ret = mtd_get_user_prot_info(mtd, 4096, &retlen, buf); 912 break; 913 default: 914 ret = -EINVAL; 915 break; 916 } 917 if (!ret) { 918 if (cmd == OTPGETREGIONCOUNT) { 919 int nbr = retlen / sizeof(struct otp_info); 920 ret = copy_to_user(argp, &nbr, sizeof(int)); 921 } else 922 ret = copy_to_user(argp, buf, retlen); 923 if (ret) 924 ret = -EFAULT; 925 } 926 kfree(buf); 927 break; 928 } 929 930 case OTPLOCK: 931 { 932 struct otp_info oinfo; 933 934 if (mfi->mode != MTD_FILE_MODE_OTP_USER) 935 return -EINVAL; 936 if (copy_from_user(&oinfo, argp, sizeof(oinfo))) 937 return -EFAULT; 938 ret = mtd_lock_user_prot_reg(mtd, oinfo.start, oinfo.length); 939 break; 940 } 941 942 /* This ioctl is being deprecated - it truncates the ECC layout */ 943 case ECCGETLAYOUT: 944 { 945 struct nand_ecclayout_user *usrlay; 946 947 if (!mtd->ecclayout) 948 return -EOPNOTSUPP; 949 950 usrlay = kmalloc(sizeof(*usrlay), GFP_KERNEL); 951 if (!usrlay) 952 return -ENOMEM; 953 954 shrink_ecclayout(mtd->ecclayout, usrlay); 955 956 if (copy_to_user(argp, usrlay, sizeof(*usrlay))) 957 ret = -EFAULT; 958 kfree(usrlay); 959 break; 960 } 961 962 case ECCGETSTATS: 963 { 964 if (copy_to_user(argp, &mtd->ecc_stats, 965 sizeof(struct mtd_ecc_stats))) 966 return -EFAULT; 967 break; 968 } 969 970 case MTDFILEMODE: 971 { 972 mfi->mode = 0; 973 974 switch(arg) { 975 case MTD_FILE_MODE_OTP_FACTORY: 976 case MTD_FILE_MODE_OTP_USER: 977 ret = otp_select_filemode(mfi, arg); 978 break; 979 980 case MTD_FILE_MODE_RAW: 981 if (!mtd_has_oob(mtd)) 982 return -EOPNOTSUPP; 983 mfi->mode = arg; 984 985 case MTD_FILE_MODE_NORMAL: 986 break; 987 default: 988 ret = -EINVAL; 989 } 990 file->f_pos = 0; 991 break; 992 } 993 994 case BLKPG: 995 { 996 ret = mtdchar_blkpg_ioctl(mtd, 997 (struct blkpg_ioctl_arg __user *)arg); 998 break; 999 } 1000 1001 case BLKRRPART: 1002 { 1003 /* No reread partition feature. Just return ok */ 1004 ret = 0; 1005 break; 1006 } 1007 1008 default: 1009 ret = -ENOTTY; 1010 } 1011 1012 return ret; 1013 } /* memory_ioctl */ 1014 1015 static long mtdchar_unlocked_ioctl(struct file *file, u_int cmd, u_long arg) 1016 { 1017 int ret; 1018 1019 mutex_lock(&mtd_mutex); 1020 ret = mtdchar_ioctl(file, cmd, arg); 1021 mutex_unlock(&mtd_mutex); 1022 1023 return ret; 1024 } 1025 1026 #ifdef CONFIG_COMPAT 1027 1028 struct mtd_oob_buf32 { 1029 u_int32_t start; 1030 u_int32_t length; 1031 compat_caddr_t ptr; /* unsigned char* */ 1032 }; 1033 1034 #define MEMWRITEOOB32 _IOWR('M', 3, struct mtd_oob_buf32) 1035 #define MEMREADOOB32 _IOWR('M', 4, struct mtd_oob_buf32) 1036 1037 static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd, 1038 unsigned long arg) 1039 { 1040 struct mtd_file_info *mfi = file->private_data; 1041 struct mtd_info *mtd = mfi->mtd; 1042 void __user *argp = compat_ptr(arg); 1043 int ret = 0; 1044 1045 mutex_lock(&mtd_mutex); 1046 1047 switch (cmd) { 1048 case MEMWRITEOOB32: 1049 { 1050 struct mtd_oob_buf32 buf; 1051 struct mtd_oob_buf32 __user *buf_user = argp; 1052 1053 if (copy_from_user(&buf, argp, sizeof(buf))) 1054 ret = -EFAULT; 1055 else 1056 ret = mtdchar_writeoob(file, mtd, buf.start, 1057 buf.length, compat_ptr(buf.ptr), 1058 &buf_user->length); 1059 break; 1060 } 1061 1062 case MEMREADOOB32: 1063 { 1064 struct mtd_oob_buf32 buf; 1065 struct mtd_oob_buf32 __user *buf_user = argp; 1066 1067 /* NOTE: writes return length to buf->start */ 1068 if (copy_from_user(&buf, argp, sizeof(buf))) 1069 ret = -EFAULT; 1070 else 1071 ret = mtdchar_readoob(file, mtd, buf.start, 1072 buf.length, compat_ptr(buf.ptr), 1073 &buf_user->start); 1074 break; 1075 } 1076 default: 1077 ret = mtdchar_ioctl(file, cmd, (unsigned long)argp); 1078 } 1079 1080 mutex_unlock(&mtd_mutex); 1081 1082 return ret; 1083 } 1084 1085 #endif /* CONFIG_COMPAT */ 1086 1087 /* 1088 * try to determine where a shared mapping can be made 1089 * - only supported for NOMMU at the moment (MMU can't doesn't copy private 1090 * mappings) 1091 */ 1092 #ifndef CONFIG_MMU 1093 static unsigned long mtdchar_get_unmapped_area(struct file *file, 1094 unsigned long addr, 1095 unsigned long len, 1096 unsigned long pgoff, 1097 unsigned long flags) 1098 { 1099 struct mtd_file_info *mfi = file->private_data; 1100 struct mtd_info *mtd = mfi->mtd; 1101 unsigned long offset; 1102 int ret; 1103 1104 if (addr != 0) 1105 return (unsigned long) -EINVAL; 1106 1107 if (len > mtd->size || pgoff >= (mtd->size >> PAGE_SHIFT)) 1108 return (unsigned long) -EINVAL; 1109 1110 offset = pgoff << PAGE_SHIFT; 1111 if (offset > mtd->size - len) 1112 return (unsigned long) -EINVAL; 1113 1114 ret = mtd_get_unmapped_area(mtd, len, offset, flags); 1115 return ret == -EOPNOTSUPP ? -ENODEV : ret; 1116 } 1117 #endif 1118 1119 /* 1120 * set up a mapping for shared memory segments 1121 */ 1122 static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma) 1123 { 1124 #ifdef CONFIG_MMU 1125 struct mtd_file_info *mfi = file->private_data; 1126 struct mtd_info *mtd = mfi->mtd; 1127 struct map_info *map = mtd->priv; 1128 1129 /* This is broken because it assumes the MTD device is map-based 1130 and that mtd->priv is a valid struct map_info. It should be 1131 replaced with something that uses the mtd_get_unmapped_area() 1132 operation properly. */ 1133 if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) { 1134 #ifdef pgprot_noncached 1135 if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory)) 1136 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); 1137 #endif 1138 return vm_iomap_memory(vma, map->phys, map->size); 1139 } 1140 return -ENODEV; 1141 #else 1142 return vma->vm_flags & VM_SHARED ? 0 : -EACCES; 1143 #endif 1144 } 1145 1146 static const struct file_operations mtd_fops = { 1147 .owner = THIS_MODULE, 1148 .llseek = mtdchar_lseek, 1149 .read = mtdchar_read, 1150 .write = mtdchar_write, 1151 .unlocked_ioctl = mtdchar_unlocked_ioctl, 1152 #ifdef CONFIG_COMPAT 1153 .compat_ioctl = mtdchar_compat_ioctl, 1154 #endif 1155 .open = mtdchar_open, 1156 .release = mtdchar_close, 1157 .mmap = mtdchar_mmap, 1158 #ifndef CONFIG_MMU 1159 .get_unmapped_area = mtdchar_get_unmapped_area, 1160 #endif 1161 }; 1162 1163 static const struct super_operations mtd_ops = { 1164 .drop_inode = generic_delete_inode, 1165 .statfs = simple_statfs, 1166 }; 1167 1168 static struct dentry *mtd_inodefs_mount(struct file_system_type *fs_type, 1169 int flags, const char *dev_name, void *data) 1170 { 1171 return mount_pseudo(fs_type, "mtd_inode:", &mtd_ops, NULL, MTD_INODE_FS_MAGIC); 1172 } 1173 1174 static struct file_system_type mtd_inodefs_type = { 1175 .name = "mtd_inodefs", 1176 .mount = mtd_inodefs_mount, 1177 .kill_sb = kill_anon_super, 1178 }; 1179 MODULE_ALIAS_FS("mtd_inodefs"); 1180 1181 int __init init_mtdchar(void) 1182 { 1183 int ret; 1184 1185 ret = __register_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, 1186 "mtd", &mtd_fops); 1187 if (ret < 0) { 1188 pr_err("Can't allocate major number %d for MTD\n", 1189 MTD_CHAR_MAJOR); 1190 return ret; 1191 } 1192 1193 ret = register_filesystem(&mtd_inodefs_type); 1194 if (ret) { 1195 pr_err("Can't register mtd_inodefs filesystem, error %d\n", 1196 ret); 1197 goto err_unregister_chdev; 1198 } 1199 1200 return ret; 1201 1202 err_unregister_chdev: 1203 __unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd"); 1204 return ret; 1205 } 1206 1207 void __exit cleanup_mtdchar(void) 1208 { 1209 unregister_filesystem(&mtd_inodefs_type); 1210 __unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd"); 1211 } 1212 1213 MODULE_ALIAS_CHARDEV_MAJOR(MTD_CHAR_MAJOR); 1214