xref: /openbmc/linux/drivers/mtd/mtdchar.c (revision abfbd895)
1 /*
2  * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software
16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
17  *
18  */
19 
20 #include <linux/device.h>
21 #include <linux/fs.h>
22 #include <linux/mm.h>
23 #include <linux/err.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/module.h>
27 #include <linux/slab.h>
28 #include <linux/sched.h>
29 #include <linux/mutex.h>
30 #include <linux/backing-dev.h>
31 #include <linux/compat.h>
32 #include <linux/mount.h>
33 #include <linux/blkpg.h>
34 #include <linux/magic.h>
35 #include <linux/major.h>
36 #include <linux/mtd/mtd.h>
37 #include <linux/mtd/partitions.h>
38 #include <linux/mtd/map.h>
39 
40 #include <asm/uaccess.h>
41 
42 #include "mtdcore.h"
43 
44 static DEFINE_MUTEX(mtd_mutex);
45 
46 /*
47  * Data structure to hold the pointer to the mtd device as well
48  * as mode information of various use cases.
49  */
50 struct mtd_file_info {
51 	struct mtd_info *mtd;
52 	enum mtd_file_modes mode;
53 };
54 
55 static loff_t mtdchar_lseek(struct file *file, loff_t offset, int orig)
56 {
57 	struct mtd_file_info *mfi = file->private_data;
58 	return fixed_size_llseek(file, offset, orig, mfi->mtd->size);
59 }
60 
61 static int mtdchar_open(struct inode *inode, struct file *file)
62 {
63 	int minor = iminor(inode);
64 	int devnum = minor >> 1;
65 	int ret = 0;
66 	struct mtd_info *mtd;
67 	struct mtd_file_info *mfi;
68 
69 	pr_debug("MTD_open\n");
70 
71 	/* You can't open the RO devices RW */
72 	if ((file->f_mode & FMODE_WRITE) && (minor & 1))
73 		return -EACCES;
74 
75 	mutex_lock(&mtd_mutex);
76 	mtd = get_mtd_device(NULL, devnum);
77 
78 	if (IS_ERR(mtd)) {
79 		ret = PTR_ERR(mtd);
80 		goto out;
81 	}
82 
83 	if (mtd->type == MTD_ABSENT) {
84 		ret = -ENODEV;
85 		goto out1;
86 	}
87 
88 	/* You can't open it RW if it's not a writeable device */
89 	if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) {
90 		ret = -EACCES;
91 		goto out1;
92 	}
93 
94 	mfi = kzalloc(sizeof(*mfi), GFP_KERNEL);
95 	if (!mfi) {
96 		ret = -ENOMEM;
97 		goto out1;
98 	}
99 	mfi->mtd = mtd;
100 	file->private_data = mfi;
101 	mutex_unlock(&mtd_mutex);
102 	return 0;
103 
104 out1:
105 	put_mtd_device(mtd);
106 out:
107 	mutex_unlock(&mtd_mutex);
108 	return ret;
109 } /* mtdchar_open */
110 
111 /*====================================================================*/
112 
113 static int mtdchar_close(struct inode *inode, struct file *file)
114 {
115 	struct mtd_file_info *mfi = file->private_data;
116 	struct mtd_info *mtd = mfi->mtd;
117 
118 	pr_debug("MTD_close\n");
119 
120 	/* Only sync if opened RW */
121 	if ((file->f_mode & FMODE_WRITE))
122 		mtd_sync(mtd);
123 
124 	put_mtd_device(mtd);
125 	file->private_data = NULL;
126 	kfree(mfi);
127 
128 	return 0;
129 } /* mtdchar_close */
130 
131 /* Back in June 2001, dwmw2 wrote:
132  *
133  *   FIXME: This _really_ needs to die. In 2.5, we should lock the
134  *   userspace buffer down and use it directly with readv/writev.
135  *
136  * The implementation below, using mtd_kmalloc_up_to, mitigates
137  * allocation failures when the system is under low-memory situations
138  * or if memory is highly fragmented at the cost of reducing the
139  * performance of the requested transfer due to a smaller buffer size.
140  *
141  * A more complex but more memory-efficient implementation based on
142  * get_user_pages and iovecs to cover extents of those pages is a
143  * longer-term goal, as intimated by dwmw2 above. However, for the
144  * write case, this requires yet more complex head and tail transfer
145  * handling when those head and tail offsets and sizes are such that
146  * alignment requirements are not met in the NAND subdriver.
147  */
148 
149 static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count,
150 			loff_t *ppos)
151 {
152 	struct mtd_file_info *mfi = file->private_data;
153 	struct mtd_info *mtd = mfi->mtd;
154 	size_t retlen;
155 	size_t total_retlen=0;
156 	int ret=0;
157 	int len;
158 	size_t size = count;
159 	char *kbuf;
160 
161 	pr_debug("MTD_read\n");
162 
163 	if (*ppos + count > mtd->size)
164 		count = mtd->size - *ppos;
165 
166 	if (!count)
167 		return 0;
168 
169 	kbuf = mtd_kmalloc_up_to(mtd, &size);
170 	if (!kbuf)
171 		return -ENOMEM;
172 
173 	while (count) {
174 		len = min_t(size_t, count, size);
175 
176 		switch (mfi->mode) {
177 		case MTD_FILE_MODE_OTP_FACTORY:
178 			ret = mtd_read_fact_prot_reg(mtd, *ppos, len,
179 						     &retlen, kbuf);
180 			break;
181 		case MTD_FILE_MODE_OTP_USER:
182 			ret = mtd_read_user_prot_reg(mtd, *ppos, len,
183 						     &retlen, kbuf);
184 			break;
185 		case MTD_FILE_MODE_RAW:
186 		{
187 			struct mtd_oob_ops ops;
188 
189 			ops.mode = MTD_OPS_RAW;
190 			ops.datbuf = kbuf;
191 			ops.oobbuf = NULL;
192 			ops.len = len;
193 
194 			ret = mtd_read_oob(mtd, *ppos, &ops);
195 			retlen = ops.retlen;
196 			break;
197 		}
198 		default:
199 			ret = mtd_read(mtd, *ppos, len, &retlen, kbuf);
200 		}
201 		/* Nand returns -EBADMSG on ECC errors, but it returns
202 		 * the data. For our userspace tools it is important
203 		 * to dump areas with ECC errors!
204 		 * For kernel internal usage it also might return -EUCLEAN
205 		 * to signal the caller that a bitflip has occurred and has
206 		 * been corrected by the ECC algorithm.
207 		 * Userspace software which accesses NAND this way
208 		 * must be aware of the fact that it deals with NAND
209 		 */
210 		if (!ret || mtd_is_bitflip_or_eccerr(ret)) {
211 			*ppos += retlen;
212 			if (copy_to_user(buf, kbuf, retlen)) {
213 				kfree(kbuf);
214 				return -EFAULT;
215 			}
216 			else
217 				total_retlen += retlen;
218 
219 			count -= retlen;
220 			buf += retlen;
221 			if (retlen == 0)
222 				count = 0;
223 		}
224 		else {
225 			kfree(kbuf);
226 			return ret;
227 		}
228 
229 	}
230 
231 	kfree(kbuf);
232 	return total_retlen;
233 } /* mtdchar_read */
234 
235 static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t count,
236 			loff_t *ppos)
237 {
238 	struct mtd_file_info *mfi = file->private_data;
239 	struct mtd_info *mtd = mfi->mtd;
240 	size_t size = count;
241 	char *kbuf;
242 	size_t retlen;
243 	size_t total_retlen=0;
244 	int ret=0;
245 	int len;
246 
247 	pr_debug("MTD_write\n");
248 
249 	if (*ppos == mtd->size)
250 		return -ENOSPC;
251 
252 	if (*ppos + count > mtd->size)
253 		count = mtd->size - *ppos;
254 
255 	if (!count)
256 		return 0;
257 
258 	kbuf = mtd_kmalloc_up_to(mtd, &size);
259 	if (!kbuf)
260 		return -ENOMEM;
261 
262 	while (count) {
263 		len = min_t(size_t, count, size);
264 
265 		if (copy_from_user(kbuf, buf, len)) {
266 			kfree(kbuf);
267 			return -EFAULT;
268 		}
269 
270 		switch (mfi->mode) {
271 		case MTD_FILE_MODE_OTP_FACTORY:
272 			ret = -EROFS;
273 			break;
274 		case MTD_FILE_MODE_OTP_USER:
275 			ret = mtd_write_user_prot_reg(mtd, *ppos, len,
276 						      &retlen, kbuf);
277 			break;
278 
279 		case MTD_FILE_MODE_RAW:
280 		{
281 			struct mtd_oob_ops ops;
282 
283 			ops.mode = MTD_OPS_RAW;
284 			ops.datbuf = kbuf;
285 			ops.oobbuf = NULL;
286 			ops.ooboffs = 0;
287 			ops.len = len;
288 
289 			ret = mtd_write_oob(mtd, *ppos, &ops);
290 			retlen = ops.retlen;
291 			break;
292 		}
293 
294 		default:
295 			ret = mtd_write(mtd, *ppos, len, &retlen, kbuf);
296 		}
297 
298 		/*
299 		 * Return -ENOSPC only if no data could be written at all.
300 		 * Otherwise just return the number of bytes that actually
301 		 * have been written.
302 		 */
303 		if ((ret == -ENOSPC) && (total_retlen))
304 			break;
305 
306 		if (!ret) {
307 			*ppos += retlen;
308 			total_retlen += retlen;
309 			count -= retlen;
310 			buf += retlen;
311 		}
312 		else {
313 			kfree(kbuf);
314 			return ret;
315 		}
316 	}
317 
318 	kfree(kbuf);
319 	return total_retlen;
320 } /* mtdchar_write */
321 
322 /*======================================================================
323 
324     IOCTL calls for getting device parameters.
325 
326 ======================================================================*/
327 static void mtdchar_erase_callback (struct erase_info *instr)
328 {
329 	wake_up((wait_queue_head_t *)instr->priv);
330 }
331 
332 static int otp_select_filemode(struct mtd_file_info *mfi, int mode)
333 {
334 	struct mtd_info *mtd = mfi->mtd;
335 	size_t retlen;
336 
337 	switch (mode) {
338 	case MTD_OTP_FACTORY:
339 		if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) ==
340 				-EOPNOTSUPP)
341 			return -EOPNOTSUPP;
342 
343 		mfi->mode = MTD_FILE_MODE_OTP_FACTORY;
344 		break;
345 	case MTD_OTP_USER:
346 		if (mtd_read_user_prot_reg(mtd, -1, 0, &retlen, NULL) ==
347 				-EOPNOTSUPP)
348 			return -EOPNOTSUPP;
349 
350 		mfi->mode = MTD_FILE_MODE_OTP_USER;
351 		break;
352 	case MTD_OTP_OFF:
353 		mfi->mode = MTD_FILE_MODE_NORMAL;
354 		break;
355 	default:
356 		return -EINVAL;
357 	}
358 
359 	return 0;
360 }
361 
362 static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
363 	uint64_t start, uint32_t length, void __user *ptr,
364 	uint32_t __user *retp)
365 {
366 	struct mtd_file_info *mfi = file->private_data;
367 	struct mtd_oob_ops ops;
368 	uint32_t retlen;
369 	int ret = 0;
370 
371 	if (!(file->f_mode & FMODE_WRITE))
372 		return -EPERM;
373 
374 	if (length > 4096)
375 		return -EINVAL;
376 
377 	if (!mtd->_write_oob)
378 		ret = -EOPNOTSUPP;
379 	else
380 		ret = access_ok(VERIFY_READ, ptr, length) ? 0 : -EFAULT;
381 
382 	if (ret)
383 		return ret;
384 
385 	ops.ooblen = length;
386 	ops.ooboffs = start & (mtd->writesize - 1);
387 	ops.datbuf = NULL;
388 	ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW :
389 		MTD_OPS_PLACE_OOB;
390 
391 	if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
392 		return -EINVAL;
393 
394 	ops.oobbuf = memdup_user(ptr, length);
395 	if (IS_ERR(ops.oobbuf))
396 		return PTR_ERR(ops.oobbuf);
397 
398 	start &= ~((uint64_t)mtd->writesize - 1);
399 	ret = mtd_write_oob(mtd, start, &ops);
400 
401 	if (ops.oobretlen > 0xFFFFFFFFU)
402 		ret = -EOVERFLOW;
403 	retlen = ops.oobretlen;
404 	if (copy_to_user(retp, &retlen, sizeof(length)))
405 		ret = -EFAULT;
406 
407 	kfree(ops.oobbuf);
408 	return ret;
409 }
410 
411 static int mtdchar_readoob(struct file *file, struct mtd_info *mtd,
412 	uint64_t start, uint32_t length, void __user *ptr,
413 	uint32_t __user *retp)
414 {
415 	struct mtd_file_info *mfi = file->private_data;
416 	struct mtd_oob_ops ops;
417 	int ret = 0;
418 
419 	if (length > 4096)
420 		return -EINVAL;
421 
422 	if (!access_ok(VERIFY_WRITE, ptr, length))
423 		return -EFAULT;
424 
425 	ops.ooblen = length;
426 	ops.ooboffs = start & (mtd->writesize - 1);
427 	ops.datbuf = NULL;
428 	ops.mode = (mfi->mode == MTD_FILE_MODE_RAW) ? MTD_OPS_RAW :
429 		MTD_OPS_PLACE_OOB;
430 
431 	if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
432 		return -EINVAL;
433 
434 	ops.oobbuf = kmalloc(length, GFP_KERNEL);
435 	if (!ops.oobbuf)
436 		return -ENOMEM;
437 
438 	start &= ~((uint64_t)mtd->writesize - 1);
439 	ret = mtd_read_oob(mtd, start, &ops);
440 
441 	if (put_user(ops.oobretlen, retp))
442 		ret = -EFAULT;
443 	else if (ops.oobretlen && copy_to_user(ptr, ops.oobbuf,
444 					    ops.oobretlen))
445 		ret = -EFAULT;
446 
447 	kfree(ops.oobbuf);
448 
449 	/*
450 	 * NAND returns -EBADMSG on ECC errors, but it returns the OOB
451 	 * data. For our userspace tools it is important to dump areas
452 	 * with ECC errors!
453 	 * For kernel internal usage it also might return -EUCLEAN
454 	 * to signal the caller that a bitflip has occured and has
455 	 * been corrected by the ECC algorithm.
456 	 *
457 	 * Note: currently the standard NAND function, nand_read_oob_std,
458 	 * does not calculate ECC for the OOB area, so do not rely on
459 	 * this behavior unless you have replaced it with your own.
460 	 */
461 	if (mtd_is_bitflip_or_eccerr(ret))
462 		return 0;
463 
464 	return ret;
465 }
466 
467 /*
468  * Copies (and truncates, if necessary) data from the larger struct,
469  * nand_ecclayout, to the smaller, deprecated layout struct,
470  * nand_ecclayout_user. This is necessary only to support the deprecated
471  * API ioctl ECCGETLAYOUT while allowing all new functionality to use
472  * nand_ecclayout flexibly (i.e. the struct may change size in new
473  * releases without requiring major rewrites).
474  */
475 static int shrink_ecclayout(const struct nand_ecclayout *from,
476 		struct nand_ecclayout_user *to)
477 {
478 	int i;
479 
480 	if (!from || !to)
481 		return -EINVAL;
482 
483 	memset(to, 0, sizeof(*to));
484 
485 	to->eccbytes = min((int)from->eccbytes, MTD_MAX_ECCPOS_ENTRIES);
486 	for (i = 0; i < to->eccbytes; i++)
487 		to->eccpos[i] = from->eccpos[i];
488 
489 	for (i = 0; i < MTD_MAX_OOBFREE_ENTRIES; i++) {
490 		if (from->oobfree[i].length == 0 &&
491 				from->oobfree[i].offset == 0)
492 			break;
493 		to->oobavail += from->oobfree[i].length;
494 		to->oobfree[i] = from->oobfree[i];
495 	}
496 
497 	return 0;
498 }
499 
500 static int mtdchar_blkpg_ioctl(struct mtd_info *mtd,
501 			       struct blkpg_ioctl_arg *arg)
502 {
503 	struct blkpg_partition p;
504 
505 	if (!capable(CAP_SYS_ADMIN))
506 		return -EPERM;
507 
508 	if (copy_from_user(&p, arg->data, sizeof(p)))
509 		return -EFAULT;
510 
511 	switch (arg->op) {
512 	case BLKPG_ADD_PARTITION:
513 
514 		/* Only master mtd device must be used to add partitions */
515 		if (mtd_is_partition(mtd))
516 			return -EINVAL;
517 
518 		/* Sanitize user input */
519 		p.devname[BLKPG_DEVNAMELTH - 1] = '\0';
520 
521 		return mtd_add_partition(mtd, p.devname, p.start, p.length);
522 
523 	case BLKPG_DEL_PARTITION:
524 
525 		if (p.pno < 0)
526 			return -EINVAL;
527 
528 		return mtd_del_partition(mtd, p.pno);
529 
530 	default:
531 		return -EINVAL;
532 	}
533 }
534 
535 static int mtdchar_write_ioctl(struct mtd_info *mtd,
536 		struct mtd_write_req __user *argp)
537 {
538 	struct mtd_write_req req;
539 	struct mtd_oob_ops ops;
540 	const void __user *usr_data, *usr_oob;
541 	int ret;
542 
543 	if (copy_from_user(&req, argp, sizeof(req)))
544 		return -EFAULT;
545 
546 	usr_data = (const void __user *)(uintptr_t)req.usr_data;
547 	usr_oob = (const void __user *)(uintptr_t)req.usr_oob;
548 	if (!access_ok(VERIFY_READ, usr_data, req.len) ||
549 	    !access_ok(VERIFY_READ, usr_oob, req.ooblen))
550 		return -EFAULT;
551 
552 	if (!mtd->_write_oob)
553 		return -EOPNOTSUPP;
554 
555 	ops.mode = req.mode;
556 	ops.len = (size_t)req.len;
557 	ops.ooblen = (size_t)req.ooblen;
558 	ops.ooboffs = 0;
559 
560 	if (usr_data) {
561 		ops.datbuf = memdup_user(usr_data, ops.len);
562 		if (IS_ERR(ops.datbuf))
563 			return PTR_ERR(ops.datbuf);
564 	} else {
565 		ops.datbuf = NULL;
566 	}
567 
568 	if (usr_oob) {
569 		ops.oobbuf = memdup_user(usr_oob, ops.ooblen);
570 		if (IS_ERR(ops.oobbuf)) {
571 			kfree(ops.datbuf);
572 			return PTR_ERR(ops.oobbuf);
573 		}
574 	} else {
575 		ops.oobbuf = NULL;
576 	}
577 
578 	ret = mtd_write_oob(mtd, (loff_t)req.start, &ops);
579 
580 	kfree(ops.datbuf);
581 	kfree(ops.oobbuf);
582 
583 	return ret;
584 }
585 
586 static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
587 {
588 	struct mtd_file_info *mfi = file->private_data;
589 	struct mtd_info *mtd = mfi->mtd;
590 	void __user *argp = (void __user *)arg;
591 	int ret = 0;
592 	u_long size;
593 	struct mtd_info_user info;
594 
595 	pr_debug("MTD_ioctl\n");
596 
597 	size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
598 	if (cmd & IOC_IN) {
599 		if (!access_ok(VERIFY_READ, argp, size))
600 			return -EFAULT;
601 	}
602 	if (cmd & IOC_OUT) {
603 		if (!access_ok(VERIFY_WRITE, argp, size))
604 			return -EFAULT;
605 	}
606 
607 	switch (cmd) {
608 	case MEMGETREGIONCOUNT:
609 		if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))
610 			return -EFAULT;
611 		break;
612 
613 	case MEMGETREGIONINFO:
614 	{
615 		uint32_t ur_idx;
616 		struct mtd_erase_region_info *kr;
617 		struct region_info_user __user *ur = argp;
618 
619 		if (get_user(ur_idx, &(ur->regionindex)))
620 			return -EFAULT;
621 
622 		if (ur_idx >= mtd->numeraseregions)
623 			return -EINVAL;
624 
625 		kr = &(mtd->eraseregions[ur_idx]);
626 
627 		if (put_user(kr->offset, &(ur->offset))
628 		    || put_user(kr->erasesize, &(ur->erasesize))
629 		    || put_user(kr->numblocks, &(ur->numblocks)))
630 			return -EFAULT;
631 
632 		break;
633 	}
634 
635 	case MEMGETINFO:
636 		memset(&info, 0, sizeof(info));
637 		info.type	= mtd->type;
638 		info.flags	= mtd->flags;
639 		info.size	= mtd->size;
640 		info.erasesize	= mtd->erasesize;
641 		info.writesize	= mtd->writesize;
642 		info.oobsize	= mtd->oobsize;
643 		/* The below field is obsolete */
644 		info.padding	= 0;
645 		if (copy_to_user(argp, &info, sizeof(struct mtd_info_user)))
646 			return -EFAULT;
647 		break;
648 
649 	case MEMERASE:
650 	case MEMERASE64:
651 	{
652 		struct erase_info *erase;
653 
654 		if(!(file->f_mode & FMODE_WRITE))
655 			return -EPERM;
656 
657 		erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
658 		if (!erase)
659 			ret = -ENOMEM;
660 		else {
661 			wait_queue_head_t waitq;
662 			DECLARE_WAITQUEUE(wait, current);
663 
664 			init_waitqueue_head(&waitq);
665 
666 			if (cmd == MEMERASE64) {
667 				struct erase_info_user64 einfo64;
668 
669 				if (copy_from_user(&einfo64, argp,
670 					    sizeof(struct erase_info_user64))) {
671 					kfree(erase);
672 					return -EFAULT;
673 				}
674 				erase->addr = einfo64.start;
675 				erase->len = einfo64.length;
676 			} else {
677 				struct erase_info_user einfo32;
678 
679 				if (copy_from_user(&einfo32, argp,
680 					    sizeof(struct erase_info_user))) {
681 					kfree(erase);
682 					return -EFAULT;
683 				}
684 				erase->addr = einfo32.start;
685 				erase->len = einfo32.length;
686 			}
687 			erase->mtd = mtd;
688 			erase->callback = mtdchar_erase_callback;
689 			erase->priv = (unsigned long)&waitq;
690 
691 			/*
692 			  FIXME: Allow INTERRUPTIBLE. Which means
693 			  not having the wait_queue head on the stack.
694 
695 			  If the wq_head is on the stack, and we
696 			  leave because we got interrupted, then the
697 			  wq_head is no longer there when the
698 			  callback routine tries to wake us up.
699 			*/
700 			ret = mtd_erase(mtd, erase);
701 			if (!ret) {
702 				set_current_state(TASK_UNINTERRUPTIBLE);
703 				add_wait_queue(&waitq, &wait);
704 				if (erase->state != MTD_ERASE_DONE &&
705 				    erase->state != MTD_ERASE_FAILED)
706 					schedule();
707 				remove_wait_queue(&waitq, &wait);
708 				set_current_state(TASK_RUNNING);
709 
710 				ret = (erase->state == MTD_ERASE_FAILED)?-EIO:0;
711 			}
712 			kfree(erase);
713 		}
714 		break;
715 	}
716 
717 	case MEMWRITEOOB:
718 	{
719 		struct mtd_oob_buf buf;
720 		struct mtd_oob_buf __user *buf_user = argp;
721 
722 		/* NOTE: writes return length to buf_user->length */
723 		if (copy_from_user(&buf, argp, sizeof(buf)))
724 			ret = -EFAULT;
725 		else
726 			ret = mtdchar_writeoob(file, mtd, buf.start, buf.length,
727 				buf.ptr, &buf_user->length);
728 		break;
729 	}
730 
731 	case MEMREADOOB:
732 	{
733 		struct mtd_oob_buf buf;
734 		struct mtd_oob_buf __user *buf_user = argp;
735 
736 		/* NOTE: writes return length to buf_user->start */
737 		if (copy_from_user(&buf, argp, sizeof(buf)))
738 			ret = -EFAULT;
739 		else
740 			ret = mtdchar_readoob(file, mtd, buf.start, buf.length,
741 				buf.ptr, &buf_user->start);
742 		break;
743 	}
744 
745 	case MEMWRITEOOB64:
746 	{
747 		struct mtd_oob_buf64 buf;
748 		struct mtd_oob_buf64 __user *buf_user = argp;
749 
750 		if (copy_from_user(&buf, argp, sizeof(buf)))
751 			ret = -EFAULT;
752 		else
753 			ret = mtdchar_writeoob(file, mtd, buf.start, buf.length,
754 				(void __user *)(uintptr_t)buf.usr_ptr,
755 				&buf_user->length);
756 		break;
757 	}
758 
759 	case MEMREADOOB64:
760 	{
761 		struct mtd_oob_buf64 buf;
762 		struct mtd_oob_buf64 __user *buf_user = argp;
763 
764 		if (copy_from_user(&buf, argp, sizeof(buf)))
765 			ret = -EFAULT;
766 		else
767 			ret = mtdchar_readoob(file, mtd, buf.start, buf.length,
768 				(void __user *)(uintptr_t)buf.usr_ptr,
769 				&buf_user->length);
770 		break;
771 	}
772 
773 	case MEMWRITE:
774 	{
775 		ret = mtdchar_write_ioctl(mtd,
776 		      (struct mtd_write_req __user *)arg);
777 		break;
778 	}
779 
780 	case MEMLOCK:
781 	{
782 		struct erase_info_user einfo;
783 
784 		if (copy_from_user(&einfo, argp, sizeof(einfo)))
785 			return -EFAULT;
786 
787 		ret = mtd_lock(mtd, einfo.start, einfo.length);
788 		break;
789 	}
790 
791 	case MEMUNLOCK:
792 	{
793 		struct erase_info_user einfo;
794 
795 		if (copy_from_user(&einfo, argp, sizeof(einfo)))
796 			return -EFAULT;
797 
798 		ret = mtd_unlock(mtd, einfo.start, einfo.length);
799 		break;
800 	}
801 
802 	case MEMISLOCKED:
803 	{
804 		struct erase_info_user einfo;
805 
806 		if (copy_from_user(&einfo, argp, sizeof(einfo)))
807 			return -EFAULT;
808 
809 		ret = mtd_is_locked(mtd, einfo.start, einfo.length);
810 		break;
811 	}
812 
813 	/* Legacy interface */
814 	case MEMGETOOBSEL:
815 	{
816 		struct nand_oobinfo oi;
817 
818 		if (!mtd->ecclayout)
819 			return -EOPNOTSUPP;
820 		if (mtd->ecclayout->eccbytes > ARRAY_SIZE(oi.eccpos))
821 			return -EINVAL;
822 
823 		oi.useecc = MTD_NANDECC_AUTOPLACE;
824 		memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos));
825 		memcpy(&oi.oobfree, mtd->ecclayout->oobfree,
826 		       sizeof(oi.oobfree));
827 		oi.eccbytes = mtd->ecclayout->eccbytes;
828 
829 		if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo)))
830 			return -EFAULT;
831 		break;
832 	}
833 
834 	case MEMGETBADBLOCK:
835 	{
836 		loff_t offs;
837 
838 		if (copy_from_user(&offs, argp, sizeof(loff_t)))
839 			return -EFAULT;
840 		return mtd_block_isbad(mtd, offs);
841 		break;
842 	}
843 
844 	case MEMSETBADBLOCK:
845 	{
846 		loff_t offs;
847 
848 		if (copy_from_user(&offs, argp, sizeof(loff_t)))
849 			return -EFAULT;
850 		return mtd_block_markbad(mtd, offs);
851 		break;
852 	}
853 
854 	case OTPSELECT:
855 	{
856 		int mode;
857 		if (copy_from_user(&mode, argp, sizeof(int)))
858 			return -EFAULT;
859 
860 		mfi->mode = MTD_FILE_MODE_NORMAL;
861 
862 		ret = otp_select_filemode(mfi, mode);
863 
864 		file->f_pos = 0;
865 		break;
866 	}
867 
868 	case OTPGETREGIONCOUNT:
869 	case OTPGETREGIONINFO:
870 	{
871 		struct otp_info *buf = kmalloc(4096, GFP_KERNEL);
872 		size_t retlen;
873 		if (!buf)
874 			return -ENOMEM;
875 		switch (mfi->mode) {
876 		case MTD_FILE_MODE_OTP_FACTORY:
877 			ret = mtd_get_fact_prot_info(mtd, 4096, &retlen, buf);
878 			break;
879 		case MTD_FILE_MODE_OTP_USER:
880 			ret = mtd_get_user_prot_info(mtd, 4096, &retlen, buf);
881 			break;
882 		default:
883 			ret = -EINVAL;
884 			break;
885 		}
886 		if (!ret) {
887 			if (cmd == OTPGETREGIONCOUNT) {
888 				int nbr = retlen / sizeof(struct otp_info);
889 				ret = copy_to_user(argp, &nbr, sizeof(int));
890 			} else
891 				ret = copy_to_user(argp, buf, retlen);
892 			if (ret)
893 				ret = -EFAULT;
894 		}
895 		kfree(buf);
896 		break;
897 	}
898 
899 	case OTPLOCK:
900 	{
901 		struct otp_info oinfo;
902 
903 		if (mfi->mode != MTD_FILE_MODE_OTP_USER)
904 			return -EINVAL;
905 		if (copy_from_user(&oinfo, argp, sizeof(oinfo)))
906 			return -EFAULT;
907 		ret = mtd_lock_user_prot_reg(mtd, oinfo.start, oinfo.length);
908 		break;
909 	}
910 
911 	/* This ioctl is being deprecated - it truncates the ECC layout */
912 	case ECCGETLAYOUT:
913 	{
914 		struct nand_ecclayout_user *usrlay;
915 
916 		if (!mtd->ecclayout)
917 			return -EOPNOTSUPP;
918 
919 		usrlay = kmalloc(sizeof(*usrlay), GFP_KERNEL);
920 		if (!usrlay)
921 			return -ENOMEM;
922 
923 		shrink_ecclayout(mtd->ecclayout, usrlay);
924 
925 		if (copy_to_user(argp, usrlay, sizeof(*usrlay)))
926 			ret = -EFAULT;
927 		kfree(usrlay);
928 		break;
929 	}
930 
931 	case ECCGETSTATS:
932 	{
933 		if (copy_to_user(argp, &mtd->ecc_stats,
934 				 sizeof(struct mtd_ecc_stats)))
935 			return -EFAULT;
936 		break;
937 	}
938 
939 	case MTDFILEMODE:
940 	{
941 		mfi->mode = 0;
942 
943 		switch(arg) {
944 		case MTD_FILE_MODE_OTP_FACTORY:
945 		case MTD_FILE_MODE_OTP_USER:
946 			ret = otp_select_filemode(mfi, arg);
947 			break;
948 
949 		case MTD_FILE_MODE_RAW:
950 			if (!mtd_has_oob(mtd))
951 				return -EOPNOTSUPP;
952 			mfi->mode = arg;
953 
954 		case MTD_FILE_MODE_NORMAL:
955 			break;
956 		default:
957 			ret = -EINVAL;
958 		}
959 		file->f_pos = 0;
960 		break;
961 	}
962 
963 	case BLKPG:
964 	{
965 		struct blkpg_ioctl_arg __user *blk_arg = argp;
966 		struct blkpg_ioctl_arg a;
967 
968 		if (copy_from_user(&a, blk_arg, sizeof(a)))
969 			ret = -EFAULT;
970 		else
971 			ret = mtdchar_blkpg_ioctl(mtd, &a);
972 		break;
973 	}
974 
975 	case BLKRRPART:
976 	{
977 		/* No reread partition feature. Just return ok */
978 		ret = 0;
979 		break;
980 	}
981 
982 	default:
983 		ret = -ENOTTY;
984 	}
985 
986 	return ret;
987 } /* memory_ioctl */
988 
989 static long mtdchar_unlocked_ioctl(struct file *file, u_int cmd, u_long arg)
990 {
991 	int ret;
992 
993 	mutex_lock(&mtd_mutex);
994 	ret = mtdchar_ioctl(file, cmd, arg);
995 	mutex_unlock(&mtd_mutex);
996 
997 	return ret;
998 }
999 
1000 #ifdef CONFIG_COMPAT
1001 
1002 struct mtd_oob_buf32 {
1003 	u_int32_t start;
1004 	u_int32_t length;
1005 	compat_caddr_t ptr;	/* unsigned char* */
1006 };
1007 
1008 #define MEMWRITEOOB32		_IOWR('M', 3, struct mtd_oob_buf32)
1009 #define MEMREADOOB32		_IOWR('M', 4, struct mtd_oob_buf32)
1010 
1011 static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd,
1012 	unsigned long arg)
1013 {
1014 	struct mtd_file_info *mfi = file->private_data;
1015 	struct mtd_info *mtd = mfi->mtd;
1016 	void __user *argp = compat_ptr(arg);
1017 	int ret = 0;
1018 
1019 	mutex_lock(&mtd_mutex);
1020 
1021 	switch (cmd) {
1022 	case MEMWRITEOOB32:
1023 	{
1024 		struct mtd_oob_buf32 buf;
1025 		struct mtd_oob_buf32 __user *buf_user = argp;
1026 
1027 		if (copy_from_user(&buf, argp, sizeof(buf)))
1028 			ret = -EFAULT;
1029 		else
1030 			ret = mtdchar_writeoob(file, mtd, buf.start,
1031 				buf.length, compat_ptr(buf.ptr),
1032 				&buf_user->length);
1033 		break;
1034 	}
1035 
1036 	case MEMREADOOB32:
1037 	{
1038 		struct mtd_oob_buf32 buf;
1039 		struct mtd_oob_buf32 __user *buf_user = argp;
1040 
1041 		/* NOTE: writes return length to buf->start */
1042 		if (copy_from_user(&buf, argp, sizeof(buf)))
1043 			ret = -EFAULT;
1044 		else
1045 			ret = mtdchar_readoob(file, mtd, buf.start,
1046 				buf.length, compat_ptr(buf.ptr),
1047 				&buf_user->start);
1048 		break;
1049 	}
1050 
1051 	case BLKPG:
1052 	{
1053 		/* Convert from blkpg_compat_ioctl_arg to blkpg_ioctl_arg */
1054 		struct blkpg_compat_ioctl_arg __user *uarg = argp;
1055 		struct blkpg_compat_ioctl_arg compat_arg;
1056 		struct blkpg_ioctl_arg a;
1057 
1058 		if (copy_from_user(&compat_arg, uarg, sizeof(compat_arg))) {
1059 			ret = -EFAULT;
1060 			break;
1061 		}
1062 
1063 		memset(&a, 0, sizeof(a));
1064 		a.op = compat_arg.op;
1065 		a.flags = compat_arg.flags;
1066 		a.datalen = compat_arg.datalen;
1067 		a.data = compat_ptr(compat_arg.data);
1068 
1069 		ret = mtdchar_blkpg_ioctl(mtd, &a);
1070 		break;
1071 	}
1072 
1073 	default:
1074 		ret = mtdchar_ioctl(file, cmd, (unsigned long)argp);
1075 	}
1076 
1077 	mutex_unlock(&mtd_mutex);
1078 
1079 	return ret;
1080 }
1081 
1082 #endif /* CONFIG_COMPAT */
1083 
1084 /*
1085  * try to determine where a shared mapping can be made
1086  * - only supported for NOMMU at the moment (MMU can't doesn't copy private
1087  *   mappings)
1088  */
1089 #ifndef CONFIG_MMU
1090 static unsigned long mtdchar_get_unmapped_area(struct file *file,
1091 					   unsigned long addr,
1092 					   unsigned long len,
1093 					   unsigned long pgoff,
1094 					   unsigned long flags)
1095 {
1096 	struct mtd_file_info *mfi = file->private_data;
1097 	struct mtd_info *mtd = mfi->mtd;
1098 	unsigned long offset;
1099 	int ret;
1100 
1101 	if (addr != 0)
1102 		return (unsigned long) -EINVAL;
1103 
1104 	if (len > mtd->size || pgoff >= (mtd->size >> PAGE_SHIFT))
1105 		return (unsigned long) -EINVAL;
1106 
1107 	offset = pgoff << PAGE_SHIFT;
1108 	if (offset > mtd->size - len)
1109 		return (unsigned long) -EINVAL;
1110 
1111 	ret = mtd_get_unmapped_area(mtd, len, offset, flags);
1112 	return ret == -EOPNOTSUPP ? -ENODEV : ret;
1113 }
1114 
1115 static unsigned mtdchar_mmap_capabilities(struct file *file)
1116 {
1117 	struct mtd_file_info *mfi = file->private_data;
1118 
1119 	return mtd_mmap_capabilities(mfi->mtd);
1120 }
1121 #endif
1122 
1123 /*
1124  * set up a mapping for shared memory segments
1125  */
1126 static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
1127 {
1128 #ifdef CONFIG_MMU
1129 	struct mtd_file_info *mfi = file->private_data;
1130 	struct mtd_info *mtd = mfi->mtd;
1131 	struct map_info *map = mtd->priv;
1132 
1133         /* This is broken because it assumes the MTD device is map-based
1134 	   and that mtd->priv is a valid struct map_info.  It should be
1135 	   replaced with something that uses the mtd_get_unmapped_area()
1136 	   operation properly. */
1137 	if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
1138 #ifdef pgprot_noncached
1139 		if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory))
1140 			vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
1141 #endif
1142 		return vm_iomap_memory(vma, map->phys, map->size);
1143 	}
1144 	return -ENODEV;
1145 #else
1146 	return vma->vm_flags & VM_SHARED ? 0 : -EACCES;
1147 #endif
1148 }
1149 
1150 static const struct file_operations mtd_fops = {
1151 	.owner		= THIS_MODULE,
1152 	.llseek		= mtdchar_lseek,
1153 	.read		= mtdchar_read,
1154 	.write		= mtdchar_write,
1155 	.unlocked_ioctl	= mtdchar_unlocked_ioctl,
1156 #ifdef CONFIG_COMPAT
1157 	.compat_ioctl	= mtdchar_compat_ioctl,
1158 #endif
1159 	.open		= mtdchar_open,
1160 	.release	= mtdchar_close,
1161 	.mmap		= mtdchar_mmap,
1162 #ifndef CONFIG_MMU
1163 	.get_unmapped_area = mtdchar_get_unmapped_area,
1164 	.mmap_capabilities = mtdchar_mmap_capabilities,
1165 #endif
1166 };
1167 
1168 int __init init_mtdchar(void)
1169 {
1170 	int ret;
1171 
1172 	ret = __register_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS,
1173 				   "mtd", &mtd_fops);
1174 	if (ret < 0) {
1175 		pr_err("Can't allocate major number %d for MTD\n",
1176 		       MTD_CHAR_MAJOR);
1177 		return ret;
1178 	}
1179 
1180 	return ret;
1181 }
1182 
1183 void __exit cleanup_mtdchar(void)
1184 {
1185 	__unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd");
1186 }
1187 
1188 MODULE_ALIAS_CHARDEV_MAJOR(MTD_CHAR_MAJOR);
1189