1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org> 4 */ 5 6 #include <linux/device.h> 7 #include <linux/fs.h> 8 #include <linux/mm.h> 9 #include <linux/err.h> 10 #include <linux/init.h> 11 #include <linux/kernel.h> 12 #include <linux/module.h> 13 #include <linux/slab.h> 14 #include <linux/sched.h> 15 #include <linux/mutex.h> 16 #include <linux/backing-dev.h> 17 #include <linux/compat.h> 18 #include <linux/mount.h> 19 #include <linux/blkpg.h> 20 #include <linux/magic.h> 21 #include <linux/major.h> 22 #include <linux/mtd/mtd.h> 23 #include <linux/mtd/partitions.h> 24 #include <linux/mtd/map.h> 25 26 #include <linux/uaccess.h> 27 28 #include "mtdcore.h" 29 30 static DEFINE_MUTEX(mtd_mutex); 31 32 /* 33 * Data structure to hold the pointer to the mtd device as well 34 * as mode information of various use cases. 35 */ 36 struct mtd_file_info { 37 struct mtd_info *mtd; 38 enum mtd_file_modes mode; 39 }; 40 41 static loff_t mtdchar_lseek(struct file *file, loff_t offset, int orig) 42 { 43 struct mtd_file_info *mfi = file->private_data; 44 return fixed_size_llseek(file, offset, orig, mfi->mtd->size); 45 } 46 47 static int mtdchar_open(struct inode *inode, struct file *file) 48 { 49 int minor = iminor(inode); 50 int devnum = minor >> 1; 51 int ret = 0; 52 struct mtd_info *mtd; 53 struct mtd_file_info *mfi; 54 55 pr_debug("MTD_open\n"); 56 57 /* You can't open the RO devices RW */ 58 if ((file->f_mode & FMODE_WRITE) && (minor & 1)) 59 return -EACCES; 60 61 mutex_lock(&mtd_mutex); 62 mtd = get_mtd_device(NULL, devnum); 63 64 if (IS_ERR(mtd)) { 65 ret = PTR_ERR(mtd); 66 goto out; 67 } 68 69 if (mtd->type == MTD_ABSENT) { 70 ret = -ENODEV; 71 goto out1; 72 } 73 74 /* You can't open it RW if it's not a writeable device */ 75 if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) { 76 ret = -EACCES; 77 goto out1; 78 } 79 80 mfi = kzalloc(sizeof(*mfi), GFP_KERNEL); 81 if (!mfi) { 82 ret = -ENOMEM; 83 goto out1; 84 } 85 mfi->mtd = mtd; 86 file->private_data = mfi; 87 mutex_unlock(&mtd_mutex); 88 return 0; 89 90 out1: 91 put_mtd_device(mtd); 92 out: 93 mutex_unlock(&mtd_mutex); 94 return ret; 95 } /* mtdchar_open */ 96 97 /*====================================================================*/ 98 99 static int mtdchar_close(struct inode *inode, struct file *file) 100 { 101 struct mtd_file_info *mfi = file->private_data; 102 struct mtd_info *mtd = mfi->mtd; 103 104 pr_debug("MTD_close\n"); 105 106 /* Only sync if opened RW */ 107 if ((file->f_mode & FMODE_WRITE)) 108 mtd_sync(mtd); 109 110 put_mtd_device(mtd); 111 file->private_data = NULL; 112 kfree(mfi); 113 114 return 0; 115 } /* mtdchar_close */ 116 117 /* Back in June 2001, dwmw2 wrote: 118 * 119 * FIXME: This _really_ needs to die. In 2.5, we should lock the 120 * userspace buffer down and use it directly with readv/writev. 121 * 122 * The implementation below, using mtd_kmalloc_up_to, mitigates 123 * allocation failures when the system is under low-memory situations 124 * or if memory is highly fragmented at the cost of reducing the 125 * performance of the requested transfer due to a smaller buffer size. 126 * 127 * A more complex but more memory-efficient implementation based on 128 * get_user_pages and iovecs to cover extents of those pages is a 129 * longer-term goal, as intimated by dwmw2 above. However, for the 130 * write case, this requires yet more complex head and tail transfer 131 * handling when those head and tail offsets and sizes are such that 132 * alignment requirements are not met in the NAND subdriver. 133 */ 134 135 static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, 136 loff_t *ppos) 137 { 138 struct mtd_file_info *mfi = file->private_data; 139 struct mtd_info *mtd = mfi->mtd; 140 size_t retlen; 141 size_t total_retlen=0; 142 int ret=0; 143 int len; 144 size_t size = count; 145 char *kbuf; 146 147 pr_debug("MTD_read\n"); 148 149 if (*ppos + count > mtd->size) { 150 if (*ppos < mtd->size) 151 count = mtd->size - *ppos; 152 else 153 count = 0; 154 } 155 156 if (!count) 157 return 0; 158 159 kbuf = mtd_kmalloc_up_to(mtd, &size); 160 if (!kbuf) 161 return -ENOMEM; 162 163 while (count) { 164 len = min_t(size_t, count, size); 165 166 switch (mfi->mode) { 167 case MTD_FILE_MODE_OTP_FACTORY: 168 ret = mtd_read_fact_prot_reg(mtd, *ppos, len, 169 &retlen, kbuf); 170 break; 171 case MTD_FILE_MODE_OTP_USER: 172 ret = mtd_read_user_prot_reg(mtd, *ppos, len, 173 &retlen, kbuf); 174 break; 175 case MTD_FILE_MODE_RAW: 176 { 177 struct mtd_oob_ops ops = {}; 178 179 ops.mode = MTD_OPS_RAW; 180 ops.datbuf = kbuf; 181 ops.oobbuf = NULL; 182 ops.len = len; 183 184 ret = mtd_read_oob(mtd, *ppos, &ops); 185 retlen = ops.retlen; 186 break; 187 } 188 default: 189 ret = mtd_read(mtd, *ppos, len, &retlen, kbuf); 190 } 191 /* Nand returns -EBADMSG on ECC errors, but it returns 192 * the data. For our userspace tools it is important 193 * to dump areas with ECC errors! 194 * For kernel internal usage it also might return -EUCLEAN 195 * to signal the caller that a bitflip has occurred and has 196 * been corrected by the ECC algorithm. 197 * Userspace software which accesses NAND this way 198 * must be aware of the fact that it deals with NAND 199 */ 200 if (!ret || mtd_is_bitflip_or_eccerr(ret)) { 201 *ppos += retlen; 202 if (copy_to_user(buf, kbuf, retlen)) { 203 kfree(kbuf); 204 return -EFAULT; 205 } 206 else 207 total_retlen += retlen; 208 209 count -= retlen; 210 buf += retlen; 211 if (retlen == 0) 212 count = 0; 213 } 214 else { 215 kfree(kbuf); 216 return ret; 217 } 218 219 } 220 221 kfree(kbuf); 222 return total_retlen; 223 } /* mtdchar_read */ 224 225 static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t count, 226 loff_t *ppos) 227 { 228 struct mtd_file_info *mfi = file->private_data; 229 struct mtd_info *mtd = mfi->mtd; 230 size_t size = count; 231 char *kbuf; 232 size_t retlen; 233 size_t total_retlen=0; 234 int ret=0; 235 int len; 236 237 pr_debug("MTD_write\n"); 238 239 if (*ppos >= mtd->size) 240 return -ENOSPC; 241 242 if (*ppos + count > mtd->size) 243 count = mtd->size - *ppos; 244 245 if (!count) 246 return 0; 247 248 kbuf = mtd_kmalloc_up_to(mtd, &size); 249 if (!kbuf) 250 return -ENOMEM; 251 252 while (count) { 253 len = min_t(size_t, count, size); 254 255 if (copy_from_user(kbuf, buf, len)) { 256 kfree(kbuf); 257 return -EFAULT; 258 } 259 260 switch (mfi->mode) { 261 case MTD_FILE_MODE_OTP_FACTORY: 262 ret = -EROFS; 263 break; 264 case MTD_FILE_MODE_OTP_USER: 265 ret = mtd_write_user_prot_reg(mtd, *ppos, len, 266 &retlen, kbuf); 267 break; 268 269 case MTD_FILE_MODE_RAW: 270 { 271 struct mtd_oob_ops ops = {}; 272 273 ops.mode = MTD_OPS_RAW; 274 ops.datbuf = kbuf; 275 ops.oobbuf = NULL; 276 ops.ooboffs = 0; 277 ops.len = len; 278 279 ret = mtd_write_oob(mtd, *ppos, &ops); 280 retlen = ops.retlen; 281 break; 282 } 283 284 default: 285 ret = mtd_write(mtd, *ppos, len, &retlen, kbuf); 286 } 287 288 /* 289 * Return -ENOSPC only if no data could be written at all. 290 * Otherwise just return the number of bytes that actually 291 * have been written. 292 */ 293 if ((ret == -ENOSPC) && (total_retlen)) 294 break; 295 296 if (!ret) { 297 *ppos += retlen; 298 total_retlen += retlen; 299 count -= retlen; 300 buf += retlen; 301 } 302 else { 303 kfree(kbuf); 304 return ret; 305 } 306 } 307 308 kfree(kbuf); 309 return total_retlen; 310 } /* mtdchar_write */ 311 312 /*====================================================================== 313 314 IOCTL calls for getting device parameters. 315 316 ======================================================================*/ 317 318 static int otp_select_filemode(struct mtd_file_info *mfi, int mode) 319 { 320 struct mtd_info *mtd = mfi->mtd; 321 size_t retlen; 322 323 switch (mode) { 324 case MTD_OTP_FACTORY: 325 if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == 326 -EOPNOTSUPP) 327 return -EOPNOTSUPP; 328 329 mfi->mode = MTD_FILE_MODE_OTP_FACTORY; 330 break; 331 case MTD_OTP_USER: 332 if (mtd_read_user_prot_reg(mtd, -1, 0, &retlen, NULL) == 333 -EOPNOTSUPP) 334 return -EOPNOTSUPP; 335 336 mfi->mode = MTD_FILE_MODE_OTP_USER; 337 break; 338 case MTD_OTP_OFF: 339 mfi->mode = MTD_FILE_MODE_NORMAL; 340 break; 341 default: 342 return -EINVAL; 343 } 344 345 return 0; 346 } 347 348 static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd, 349 uint64_t start, uint32_t length, void __user *ptr, 350 uint32_t __user *retp) 351 { 352 struct mtd_info *master = mtd_get_master(mtd); 353 struct mtd_file_info *mfi = file->private_data; 354 struct mtd_oob_ops ops = {}; 355 uint32_t retlen; 356 int ret = 0; 357 358 if (!(file->f_mode & FMODE_WRITE)) 359 return -EPERM; 360 361 if (length > 4096) 362 return -EINVAL; 363 364 if (!master->_write_oob) 365 return -EOPNOTSUPP; 366 367 ops.ooblen = length; 368 ops.ooboffs = start & (mtd->writesize - 1); 369 ops.datbuf = NULL; 370 ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW : 371 MTD_OPS_PLACE_OOB; 372 373 if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs)) 374 return -EINVAL; 375 376 ops.oobbuf = memdup_user(ptr, length); 377 if (IS_ERR(ops.oobbuf)) 378 return PTR_ERR(ops.oobbuf); 379 380 start &= ~((uint64_t)mtd->writesize - 1); 381 ret = mtd_write_oob(mtd, start, &ops); 382 383 if (ops.oobretlen > 0xFFFFFFFFU) 384 ret = -EOVERFLOW; 385 retlen = ops.oobretlen; 386 if (copy_to_user(retp, &retlen, sizeof(length))) 387 ret = -EFAULT; 388 389 kfree(ops.oobbuf); 390 return ret; 391 } 392 393 static int mtdchar_readoob(struct file *file, struct mtd_info *mtd, 394 uint64_t start, uint32_t length, void __user *ptr, 395 uint32_t __user *retp) 396 { 397 struct mtd_file_info *mfi = file->private_data; 398 struct mtd_oob_ops ops = {}; 399 int ret = 0; 400 401 if (length > 4096) 402 return -EINVAL; 403 404 ops.ooblen = length; 405 ops.ooboffs = start & (mtd->writesize - 1); 406 ops.datbuf = NULL; 407 ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW : 408 MTD_OPS_PLACE_OOB; 409 410 if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs)) 411 return -EINVAL; 412 413 ops.oobbuf = kmalloc(length, GFP_KERNEL); 414 if (!ops.oobbuf) 415 return -ENOMEM; 416 417 start &= ~((uint64_t)mtd->writesize - 1); 418 ret = mtd_read_oob(mtd, start, &ops); 419 420 if (put_user(ops.oobretlen, retp)) 421 ret = -EFAULT; 422 else if (ops.oobretlen && copy_to_user(ptr, ops.oobbuf, 423 ops.oobretlen)) 424 ret = -EFAULT; 425 426 kfree(ops.oobbuf); 427 428 /* 429 * NAND returns -EBADMSG on ECC errors, but it returns the OOB 430 * data. For our userspace tools it is important to dump areas 431 * with ECC errors! 432 * For kernel internal usage it also might return -EUCLEAN 433 * to signal the caller that a bitflip has occurred and has 434 * been corrected by the ECC algorithm. 435 * 436 * Note: currently the standard NAND function, nand_read_oob_std, 437 * does not calculate ECC for the OOB area, so do not rely on 438 * this behavior unless you have replaced it with your own. 439 */ 440 if (mtd_is_bitflip_or_eccerr(ret)) 441 return 0; 442 443 return ret; 444 } 445 446 /* 447 * Copies (and truncates, if necessary) OOB layout information to the 448 * deprecated layout struct, nand_ecclayout_user. This is necessary only to 449 * support the deprecated API ioctl ECCGETLAYOUT while allowing all new 450 * functionality to use mtd_ooblayout_ops flexibly (i.e. mtd_ooblayout_ops 451 * can describe any kind of OOB layout with almost zero overhead from a 452 * memory usage point of view). 453 */ 454 static int shrink_ecclayout(struct mtd_info *mtd, 455 struct nand_ecclayout_user *to) 456 { 457 struct mtd_oob_region oobregion; 458 int i, section = 0, ret; 459 460 if (!mtd || !to) 461 return -EINVAL; 462 463 memset(to, 0, sizeof(*to)); 464 465 to->eccbytes = 0; 466 for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) { 467 u32 eccpos; 468 469 ret = mtd_ooblayout_ecc(mtd, section++, &oobregion); 470 if (ret < 0) { 471 if (ret != -ERANGE) 472 return ret; 473 474 break; 475 } 476 477 eccpos = oobregion.offset; 478 for (; i < MTD_MAX_ECCPOS_ENTRIES && 479 eccpos < oobregion.offset + oobregion.length; i++) { 480 to->eccpos[i] = eccpos++; 481 to->eccbytes++; 482 } 483 } 484 485 for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES; i++) { 486 ret = mtd_ooblayout_free(mtd, i, &oobregion); 487 if (ret < 0) { 488 if (ret != -ERANGE) 489 return ret; 490 491 break; 492 } 493 494 to->oobfree[i].offset = oobregion.offset; 495 to->oobfree[i].length = oobregion.length; 496 to->oobavail += to->oobfree[i].length; 497 } 498 499 return 0; 500 } 501 502 static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to) 503 { 504 struct mtd_oob_region oobregion; 505 int i, section = 0, ret; 506 507 if (!mtd || !to) 508 return -EINVAL; 509 510 memset(to, 0, sizeof(*to)); 511 512 to->eccbytes = 0; 513 for (i = 0; i < ARRAY_SIZE(to->eccpos);) { 514 u32 eccpos; 515 516 ret = mtd_ooblayout_ecc(mtd, section++, &oobregion); 517 if (ret < 0) { 518 if (ret != -ERANGE) 519 return ret; 520 521 break; 522 } 523 524 if (oobregion.length + i > ARRAY_SIZE(to->eccpos)) 525 return -EINVAL; 526 527 eccpos = oobregion.offset; 528 for (; eccpos < oobregion.offset + oobregion.length; i++) { 529 to->eccpos[i] = eccpos++; 530 to->eccbytes++; 531 } 532 } 533 534 for (i = 0; i < 8; i++) { 535 ret = mtd_ooblayout_free(mtd, i, &oobregion); 536 if (ret < 0) { 537 if (ret != -ERANGE) 538 return ret; 539 540 break; 541 } 542 543 to->oobfree[i][0] = oobregion.offset; 544 to->oobfree[i][1] = oobregion.length; 545 } 546 547 to->useecc = MTD_NANDECC_AUTOPLACE; 548 549 return 0; 550 } 551 552 static int mtdchar_blkpg_ioctl(struct mtd_info *mtd, 553 struct blkpg_ioctl_arg *arg) 554 { 555 struct blkpg_partition p; 556 557 if (!capable(CAP_SYS_ADMIN)) 558 return -EPERM; 559 560 if (copy_from_user(&p, arg->data, sizeof(p))) 561 return -EFAULT; 562 563 switch (arg->op) { 564 case BLKPG_ADD_PARTITION: 565 566 /* Only master mtd device must be used to add partitions */ 567 if (mtd_is_partition(mtd)) 568 return -EINVAL; 569 570 /* Sanitize user input */ 571 p.devname[BLKPG_DEVNAMELTH - 1] = '\0'; 572 573 return mtd_add_partition(mtd, p.devname, p.start, p.length); 574 575 case BLKPG_DEL_PARTITION: 576 577 if (p.pno < 0) 578 return -EINVAL; 579 580 return mtd_del_partition(mtd, p.pno); 581 582 default: 583 return -EINVAL; 584 } 585 } 586 587 static int mtdchar_write_ioctl(struct mtd_info *mtd, 588 struct mtd_write_req __user *argp) 589 { 590 struct mtd_info *master = mtd_get_master(mtd); 591 struct mtd_write_req req; 592 struct mtd_oob_ops ops = {}; 593 const void __user *usr_data, *usr_oob; 594 int ret; 595 596 if (copy_from_user(&req, argp, sizeof(req))) 597 return -EFAULT; 598 599 usr_data = (const void __user *)(uintptr_t)req.usr_data; 600 usr_oob = (const void __user *)(uintptr_t)req.usr_oob; 601 602 if (!master->_write_oob) 603 return -EOPNOTSUPP; 604 ops.mode = req.mode; 605 ops.len = (size_t)req.len; 606 ops.ooblen = (size_t)req.ooblen; 607 ops.ooboffs = 0; 608 609 if (usr_data) { 610 ops.datbuf = memdup_user(usr_data, ops.len); 611 if (IS_ERR(ops.datbuf)) 612 return PTR_ERR(ops.datbuf); 613 } else { 614 ops.datbuf = NULL; 615 } 616 617 if (usr_oob) { 618 ops.oobbuf = memdup_user(usr_oob, ops.ooblen); 619 if (IS_ERR(ops.oobbuf)) { 620 kfree(ops.datbuf); 621 return PTR_ERR(ops.oobbuf); 622 } 623 } else { 624 ops.oobbuf = NULL; 625 } 626 627 ret = mtd_write_oob(mtd, (loff_t)req.start, &ops); 628 629 kfree(ops.datbuf); 630 kfree(ops.oobbuf); 631 632 return ret; 633 } 634 635 static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) 636 { 637 struct mtd_file_info *mfi = file->private_data; 638 struct mtd_info *mtd = mfi->mtd; 639 struct mtd_info *master = mtd_get_master(mtd); 640 void __user *argp = (void __user *)arg; 641 int ret = 0; 642 struct mtd_info_user info; 643 644 pr_debug("MTD_ioctl\n"); 645 646 switch (cmd) { 647 case MEMGETREGIONCOUNT: 648 if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int))) 649 return -EFAULT; 650 break; 651 652 case MEMGETREGIONINFO: 653 { 654 uint32_t ur_idx; 655 struct mtd_erase_region_info *kr; 656 struct region_info_user __user *ur = argp; 657 658 if (get_user(ur_idx, &(ur->regionindex))) 659 return -EFAULT; 660 661 if (ur_idx >= mtd->numeraseregions) 662 return -EINVAL; 663 664 kr = &(mtd->eraseregions[ur_idx]); 665 666 if (put_user(kr->offset, &(ur->offset)) 667 || put_user(kr->erasesize, &(ur->erasesize)) 668 || put_user(kr->numblocks, &(ur->numblocks))) 669 return -EFAULT; 670 671 break; 672 } 673 674 case MEMGETINFO: 675 memset(&info, 0, sizeof(info)); 676 info.type = mtd->type; 677 info.flags = mtd->flags; 678 info.size = mtd->size; 679 info.erasesize = mtd->erasesize; 680 info.writesize = mtd->writesize; 681 info.oobsize = mtd->oobsize; 682 /* The below field is obsolete */ 683 info.padding = 0; 684 if (copy_to_user(argp, &info, sizeof(struct mtd_info_user))) 685 return -EFAULT; 686 break; 687 688 case MEMERASE: 689 case MEMERASE64: 690 { 691 struct erase_info *erase; 692 693 if(!(file->f_mode & FMODE_WRITE)) 694 return -EPERM; 695 696 erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL); 697 if (!erase) 698 ret = -ENOMEM; 699 else { 700 if (cmd == MEMERASE64) { 701 struct erase_info_user64 einfo64; 702 703 if (copy_from_user(&einfo64, argp, 704 sizeof(struct erase_info_user64))) { 705 kfree(erase); 706 return -EFAULT; 707 } 708 erase->addr = einfo64.start; 709 erase->len = einfo64.length; 710 } else { 711 struct erase_info_user einfo32; 712 713 if (copy_from_user(&einfo32, argp, 714 sizeof(struct erase_info_user))) { 715 kfree(erase); 716 return -EFAULT; 717 } 718 erase->addr = einfo32.start; 719 erase->len = einfo32.length; 720 } 721 722 ret = mtd_erase(mtd, erase); 723 kfree(erase); 724 } 725 break; 726 } 727 728 case MEMWRITEOOB: 729 { 730 struct mtd_oob_buf buf; 731 struct mtd_oob_buf __user *buf_user = argp; 732 733 /* NOTE: writes return length to buf_user->length */ 734 if (copy_from_user(&buf, argp, sizeof(buf))) 735 ret = -EFAULT; 736 else 737 ret = mtdchar_writeoob(file, mtd, buf.start, buf.length, 738 buf.ptr, &buf_user->length); 739 break; 740 } 741 742 case MEMREADOOB: 743 { 744 struct mtd_oob_buf buf; 745 struct mtd_oob_buf __user *buf_user = argp; 746 747 /* NOTE: writes return length to buf_user->start */ 748 if (copy_from_user(&buf, argp, sizeof(buf))) 749 ret = -EFAULT; 750 else 751 ret = mtdchar_readoob(file, mtd, buf.start, buf.length, 752 buf.ptr, &buf_user->start); 753 break; 754 } 755 756 case MEMWRITEOOB64: 757 { 758 struct mtd_oob_buf64 buf; 759 struct mtd_oob_buf64 __user *buf_user = argp; 760 761 if (copy_from_user(&buf, argp, sizeof(buf))) 762 ret = -EFAULT; 763 else 764 ret = mtdchar_writeoob(file, mtd, buf.start, buf.length, 765 (void __user *)(uintptr_t)buf.usr_ptr, 766 &buf_user->length); 767 break; 768 } 769 770 case MEMREADOOB64: 771 { 772 struct mtd_oob_buf64 buf; 773 struct mtd_oob_buf64 __user *buf_user = argp; 774 775 if (copy_from_user(&buf, argp, sizeof(buf))) 776 ret = -EFAULT; 777 else 778 ret = mtdchar_readoob(file, mtd, buf.start, buf.length, 779 (void __user *)(uintptr_t)buf.usr_ptr, 780 &buf_user->length); 781 break; 782 } 783 784 case MEMWRITE: 785 { 786 ret = mtdchar_write_ioctl(mtd, 787 (struct mtd_write_req __user *)arg); 788 break; 789 } 790 791 case MEMLOCK: 792 { 793 struct erase_info_user einfo; 794 795 if (copy_from_user(&einfo, argp, sizeof(einfo))) 796 return -EFAULT; 797 798 ret = mtd_lock(mtd, einfo.start, einfo.length); 799 break; 800 } 801 802 case MEMUNLOCK: 803 { 804 struct erase_info_user einfo; 805 806 if (copy_from_user(&einfo, argp, sizeof(einfo))) 807 return -EFAULT; 808 809 ret = mtd_unlock(mtd, einfo.start, einfo.length); 810 break; 811 } 812 813 case MEMISLOCKED: 814 { 815 struct erase_info_user einfo; 816 817 if (copy_from_user(&einfo, argp, sizeof(einfo))) 818 return -EFAULT; 819 820 ret = mtd_is_locked(mtd, einfo.start, einfo.length); 821 break; 822 } 823 824 /* Legacy interface */ 825 case MEMGETOOBSEL: 826 { 827 struct nand_oobinfo oi; 828 829 if (!master->ooblayout) 830 return -EOPNOTSUPP; 831 832 ret = get_oobinfo(mtd, &oi); 833 if (ret) 834 return ret; 835 836 if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo))) 837 return -EFAULT; 838 break; 839 } 840 841 case MEMGETBADBLOCK: 842 { 843 loff_t offs; 844 845 if (copy_from_user(&offs, argp, sizeof(loff_t))) 846 return -EFAULT; 847 return mtd_block_isbad(mtd, offs); 848 break; 849 } 850 851 case MEMSETBADBLOCK: 852 { 853 loff_t offs; 854 855 if (copy_from_user(&offs, argp, sizeof(loff_t))) 856 return -EFAULT; 857 return mtd_block_markbad(mtd, offs); 858 break; 859 } 860 861 case OTPSELECT: 862 { 863 int mode; 864 if (copy_from_user(&mode, argp, sizeof(int))) 865 return -EFAULT; 866 867 mfi->mode = MTD_FILE_MODE_NORMAL; 868 869 ret = otp_select_filemode(mfi, mode); 870 871 file->f_pos = 0; 872 break; 873 } 874 875 case OTPGETREGIONCOUNT: 876 case OTPGETREGIONINFO: 877 { 878 struct otp_info *buf = kmalloc(4096, GFP_KERNEL); 879 size_t retlen; 880 if (!buf) 881 return -ENOMEM; 882 switch (mfi->mode) { 883 case MTD_FILE_MODE_OTP_FACTORY: 884 ret = mtd_get_fact_prot_info(mtd, 4096, &retlen, buf); 885 break; 886 case MTD_FILE_MODE_OTP_USER: 887 ret = mtd_get_user_prot_info(mtd, 4096, &retlen, buf); 888 break; 889 default: 890 ret = -EINVAL; 891 break; 892 } 893 if (!ret) { 894 if (cmd == OTPGETREGIONCOUNT) { 895 int nbr = retlen / sizeof(struct otp_info); 896 ret = copy_to_user(argp, &nbr, sizeof(int)); 897 } else 898 ret = copy_to_user(argp, buf, retlen); 899 if (ret) 900 ret = -EFAULT; 901 } 902 kfree(buf); 903 break; 904 } 905 906 case OTPLOCK: 907 { 908 struct otp_info oinfo; 909 910 if (mfi->mode != MTD_FILE_MODE_OTP_USER) 911 return -EINVAL; 912 if (copy_from_user(&oinfo, argp, sizeof(oinfo))) 913 return -EFAULT; 914 ret = mtd_lock_user_prot_reg(mtd, oinfo.start, oinfo.length); 915 break; 916 } 917 918 /* This ioctl is being deprecated - it truncates the ECC layout */ 919 case ECCGETLAYOUT: 920 { 921 struct nand_ecclayout_user *usrlay; 922 923 if (!master->ooblayout) 924 return -EOPNOTSUPP; 925 926 usrlay = kmalloc(sizeof(*usrlay), GFP_KERNEL); 927 if (!usrlay) 928 return -ENOMEM; 929 930 shrink_ecclayout(mtd, usrlay); 931 932 if (copy_to_user(argp, usrlay, sizeof(*usrlay))) 933 ret = -EFAULT; 934 kfree(usrlay); 935 break; 936 } 937 938 case ECCGETSTATS: 939 { 940 if (copy_to_user(argp, &mtd->ecc_stats, 941 sizeof(struct mtd_ecc_stats))) 942 return -EFAULT; 943 break; 944 } 945 946 case MTDFILEMODE: 947 { 948 mfi->mode = 0; 949 950 switch(arg) { 951 case MTD_FILE_MODE_OTP_FACTORY: 952 case MTD_FILE_MODE_OTP_USER: 953 ret = otp_select_filemode(mfi, arg); 954 break; 955 956 case MTD_FILE_MODE_RAW: 957 if (!mtd_has_oob(mtd)) 958 return -EOPNOTSUPP; 959 mfi->mode = arg; 960 961 case MTD_FILE_MODE_NORMAL: 962 break; 963 default: 964 ret = -EINVAL; 965 } 966 file->f_pos = 0; 967 break; 968 } 969 970 case BLKPG: 971 { 972 struct blkpg_ioctl_arg __user *blk_arg = argp; 973 struct blkpg_ioctl_arg a; 974 975 if (copy_from_user(&a, blk_arg, sizeof(a))) 976 ret = -EFAULT; 977 else 978 ret = mtdchar_blkpg_ioctl(mtd, &a); 979 break; 980 } 981 982 case BLKRRPART: 983 { 984 /* No reread partition feature. Just return ok */ 985 ret = 0; 986 break; 987 } 988 989 default: 990 ret = -ENOTTY; 991 } 992 993 return ret; 994 } /* memory_ioctl */ 995 996 static long mtdchar_unlocked_ioctl(struct file *file, u_int cmd, u_long arg) 997 { 998 int ret; 999 1000 mutex_lock(&mtd_mutex); 1001 ret = mtdchar_ioctl(file, cmd, arg); 1002 mutex_unlock(&mtd_mutex); 1003 1004 return ret; 1005 } 1006 1007 #ifdef CONFIG_COMPAT 1008 1009 struct mtd_oob_buf32 { 1010 u_int32_t start; 1011 u_int32_t length; 1012 compat_caddr_t ptr; /* unsigned char* */ 1013 }; 1014 1015 #define MEMWRITEOOB32 _IOWR('M', 3, struct mtd_oob_buf32) 1016 #define MEMREADOOB32 _IOWR('M', 4, struct mtd_oob_buf32) 1017 1018 static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd, 1019 unsigned long arg) 1020 { 1021 struct mtd_file_info *mfi = file->private_data; 1022 struct mtd_info *mtd = mfi->mtd; 1023 void __user *argp = compat_ptr(arg); 1024 int ret = 0; 1025 1026 mutex_lock(&mtd_mutex); 1027 1028 switch (cmd) { 1029 case MEMWRITEOOB32: 1030 { 1031 struct mtd_oob_buf32 buf; 1032 struct mtd_oob_buf32 __user *buf_user = argp; 1033 1034 if (copy_from_user(&buf, argp, sizeof(buf))) 1035 ret = -EFAULT; 1036 else 1037 ret = mtdchar_writeoob(file, mtd, buf.start, 1038 buf.length, compat_ptr(buf.ptr), 1039 &buf_user->length); 1040 break; 1041 } 1042 1043 case MEMREADOOB32: 1044 { 1045 struct mtd_oob_buf32 buf; 1046 struct mtd_oob_buf32 __user *buf_user = argp; 1047 1048 /* NOTE: writes return length to buf->start */ 1049 if (copy_from_user(&buf, argp, sizeof(buf))) 1050 ret = -EFAULT; 1051 else 1052 ret = mtdchar_readoob(file, mtd, buf.start, 1053 buf.length, compat_ptr(buf.ptr), 1054 &buf_user->start); 1055 break; 1056 } 1057 1058 case BLKPG: 1059 { 1060 /* Convert from blkpg_compat_ioctl_arg to blkpg_ioctl_arg */ 1061 struct blkpg_compat_ioctl_arg __user *uarg = argp; 1062 struct blkpg_compat_ioctl_arg compat_arg; 1063 struct blkpg_ioctl_arg a; 1064 1065 if (copy_from_user(&compat_arg, uarg, sizeof(compat_arg))) { 1066 ret = -EFAULT; 1067 break; 1068 } 1069 1070 memset(&a, 0, sizeof(a)); 1071 a.op = compat_arg.op; 1072 a.flags = compat_arg.flags; 1073 a.datalen = compat_arg.datalen; 1074 a.data = compat_ptr(compat_arg.data); 1075 1076 ret = mtdchar_blkpg_ioctl(mtd, &a); 1077 break; 1078 } 1079 1080 default: 1081 ret = mtdchar_ioctl(file, cmd, (unsigned long)argp); 1082 } 1083 1084 mutex_unlock(&mtd_mutex); 1085 1086 return ret; 1087 } 1088 1089 #endif /* CONFIG_COMPAT */ 1090 1091 /* 1092 * try to determine where a shared mapping can be made 1093 * - only supported for NOMMU at the moment (MMU can't doesn't copy private 1094 * mappings) 1095 */ 1096 #ifndef CONFIG_MMU 1097 static unsigned long mtdchar_get_unmapped_area(struct file *file, 1098 unsigned long addr, 1099 unsigned long len, 1100 unsigned long pgoff, 1101 unsigned long flags) 1102 { 1103 struct mtd_file_info *mfi = file->private_data; 1104 struct mtd_info *mtd = mfi->mtd; 1105 unsigned long offset; 1106 int ret; 1107 1108 if (addr != 0) 1109 return (unsigned long) -EINVAL; 1110 1111 if (len > mtd->size || pgoff >= (mtd->size >> PAGE_SHIFT)) 1112 return (unsigned long) -EINVAL; 1113 1114 offset = pgoff << PAGE_SHIFT; 1115 if (offset > mtd->size - len) 1116 return (unsigned long) -EINVAL; 1117 1118 ret = mtd_get_unmapped_area(mtd, len, offset, flags); 1119 return ret == -EOPNOTSUPP ? -ENODEV : ret; 1120 } 1121 1122 static unsigned mtdchar_mmap_capabilities(struct file *file) 1123 { 1124 struct mtd_file_info *mfi = file->private_data; 1125 1126 return mtd_mmap_capabilities(mfi->mtd); 1127 } 1128 #endif 1129 1130 /* 1131 * set up a mapping for shared memory segments 1132 */ 1133 static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma) 1134 { 1135 #ifdef CONFIG_MMU 1136 struct mtd_file_info *mfi = file->private_data; 1137 struct mtd_info *mtd = mfi->mtd; 1138 struct map_info *map = mtd->priv; 1139 1140 /* This is broken because it assumes the MTD device is map-based 1141 and that mtd->priv is a valid struct map_info. It should be 1142 replaced with something that uses the mtd_get_unmapped_area() 1143 operation properly. */ 1144 if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) { 1145 #ifdef pgprot_noncached 1146 if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory)) 1147 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); 1148 #endif 1149 return vm_iomap_memory(vma, map->phys, map->size); 1150 } 1151 return -ENODEV; 1152 #else 1153 return vma->vm_flags & VM_SHARED ? 0 : -EACCES; 1154 #endif 1155 } 1156 1157 static const struct file_operations mtd_fops = { 1158 .owner = THIS_MODULE, 1159 .llseek = mtdchar_lseek, 1160 .read = mtdchar_read, 1161 .write = mtdchar_write, 1162 .unlocked_ioctl = mtdchar_unlocked_ioctl, 1163 #ifdef CONFIG_COMPAT 1164 .compat_ioctl = mtdchar_compat_ioctl, 1165 #endif 1166 .open = mtdchar_open, 1167 .release = mtdchar_close, 1168 .mmap = mtdchar_mmap, 1169 #ifndef CONFIG_MMU 1170 .get_unmapped_area = mtdchar_get_unmapped_area, 1171 .mmap_capabilities = mtdchar_mmap_capabilities, 1172 #endif 1173 }; 1174 1175 int __init init_mtdchar(void) 1176 { 1177 int ret; 1178 1179 ret = __register_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, 1180 "mtd", &mtd_fops); 1181 if (ret < 0) { 1182 pr_err("Can't allocate major number %d for MTD\n", 1183 MTD_CHAR_MAJOR); 1184 return ret; 1185 } 1186 1187 return ret; 1188 } 1189 1190 void __exit cleanup_mtdchar(void) 1191 { 1192 __unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd"); 1193 } 1194 1195 MODULE_ALIAS_CHARDEV_MAJOR(MTD_CHAR_MAJOR); 1196