md: avoid overflow in raid0 calculation with large components
[linux-2.6.22.y-op.git] / drivers / mtd / mtdchar.c
blob8c86b802f212afa98ca588d06717e46d4b9afe3f
1 /*
2 * $Id: mtdchar.c,v 1.76 2005/11/07 11:14:20 gleixner Exp $
4 * Character-device access to raw MTD devices.
6 */
8 #include <linux/device.h>
9 #include <linux/fs.h>
10 #include <linux/err.h>
11 #include <linux/init.h>
12 #include <linux/kernel.h>
13 #include <linux/module.h>
14 #include <linux/slab.h>
15 #include <linux/sched.h>
17 #include <linux/mtd/mtd.h>
18 #include <linux/mtd/compatmac.h>
20 #include <asm/uaccess.h>
22 static struct class *mtd_class;
24 static void mtd_notify_add(struct mtd_info* mtd)
26 if (!mtd)
27 return;
29 class_device_create(mtd_class, NULL, MKDEV(MTD_CHAR_MAJOR, mtd->index*2),
30 NULL, "mtd%d", mtd->index);
32 class_device_create(mtd_class, NULL,
33 MKDEV(MTD_CHAR_MAJOR, mtd->index*2+1),
34 NULL, "mtd%dro", mtd->index);
37 static void mtd_notify_remove(struct mtd_info* mtd)
39 if (!mtd)
40 return;
42 class_device_destroy(mtd_class, MKDEV(MTD_CHAR_MAJOR, mtd->index*2));
43 class_device_destroy(mtd_class, MKDEV(MTD_CHAR_MAJOR, mtd->index*2+1));
46 static struct mtd_notifier notifier = {
47 .add = mtd_notify_add,
48 .remove = mtd_notify_remove,
52 * Data structure to hold the pointer to the mtd device as well
53 * as mode information ofr various use cases.
55 struct mtd_file_info {
56 struct mtd_info *mtd;
57 enum mtd_file_modes mode;
60 static loff_t mtd_lseek (struct file *file, loff_t offset, int orig)
62 struct mtd_file_info *mfi = file->private_data;
63 struct mtd_info *mtd = mfi->mtd;
65 switch (orig) {
66 case SEEK_SET:
67 break;
68 case SEEK_CUR:
69 offset += file->f_pos;
70 break;
71 case SEEK_END:
72 offset += mtd->size;
73 break;
74 default:
75 return -EINVAL;
78 if (offset >= 0 && offset <= mtd->size)
79 return file->f_pos = offset;
81 return -EINVAL;
86 static int mtd_open(struct inode *inode, struct file *file)
88 int minor = iminor(inode);
89 int devnum = minor >> 1;
90 struct mtd_info *mtd;
91 struct mtd_file_info *mfi;
93 DEBUG(MTD_DEBUG_LEVEL0, "MTD_open\n");
95 if (devnum >= MAX_MTD_DEVICES)
96 return -ENODEV;
98 /* You can't open the RO devices RW */
99 if ((file->f_mode & 2) && (minor & 1))
100 return -EACCES;
102 mtd = get_mtd_device(NULL, devnum);
104 if (IS_ERR(mtd))
105 return PTR_ERR(mtd);
107 if (MTD_ABSENT == mtd->type) {
108 put_mtd_device(mtd);
109 return -ENODEV;
112 /* You can't open it RW if it's not a writeable device */
113 if ((file->f_mode & 2) && !(mtd->flags & MTD_WRITEABLE)) {
114 put_mtd_device(mtd);
115 return -EACCES;
118 mfi = kzalloc(sizeof(*mfi), GFP_KERNEL);
119 if (!mfi) {
120 put_mtd_device(mtd);
121 return -ENOMEM;
123 mfi->mtd = mtd;
124 file->private_data = mfi;
126 return 0;
127 } /* mtd_open */
129 /*====================================================================*/
131 static int mtd_close(struct inode *inode, struct file *file)
133 struct mtd_file_info *mfi = file->private_data;
134 struct mtd_info *mtd = mfi->mtd;
136 DEBUG(MTD_DEBUG_LEVEL0, "MTD_close\n");
138 if (mtd->sync)
139 mtd->sync(mtd);
141 put_mtd_device(mtd);
142 file->private_data = NULL;
143 kfree(mfi);
145 return 0;
146 } /* mtd_close */
148 /* FIXME: This _really_ needs to die. In 2.5, we should lock the
149 userspace buffer down and use it directly with readv/writev.
151 #define MAX_KMALLOC_SIZE 0x20000
153 static ssize_t mtd_read(struct file *file, char __user *buf, size_t count,loff_t *ppos)
155 struct mtd_file_info *mfi = file->private_data;
156 struct mtd_info *mtd = mfi->mtd;
157 size_t retlen=0;
158 size_t total_retlen=0;
159 int ret=0;
160 int len;
161 char *kbuf;
163 DEBUG(MTD_DEBUG_LEVEL0,"MTD_read\n");
165 if (*ppos + count > mtd->size)
166 count = mtd->size - *ppos;
168 if (!count)
169 return 0;
171 /* FIXME: Use kiovec in 2.5 to lock down the user's buffers
172 and pass them directly to the MTD functions */
174 if (count > MAX_KMALLOC_SIZE)
175 kbuf=kmalloc(MAX_KMALLOC_SIZE, GFP_KERNEL);
176 else
177 kbuf=kmalloc(count, GFP_KERNEL);
179 if (!kbuf)
180 return -ENOMEM;
182 while (count) {
184 if (count > MAX_KMALLOC_SIZE)
185 len = MAX_KMALLOC_SIZE;
186 else
187 len = count;
189 switch (mfi->mode) {
190 case MTD_MODE_OTP_FACTORY:
191 ret = mtd->read_fact_prot_reg(mtd, *ppos, len, &retlen, kbuf);
192 break;
193 case MTD_MODE_OTP_USER:
194 ret = mtd->read_user_prot_reg(mtd, *ppos, len, &retlen, kbuf);
195 break;
196 case MTD_MODE_RAW:
198 struct mtd_oob_ops ops;
200 ops.mode = MTD_OOB_RAW;
201 ops.datbuf = kbuf;
202 ops.oobbuf = NULL;
203 ops.len = len;
205 ret = mtd->read_oob(mtd, *ppos, &ops);
206 retlen = ops.retlen;
207 break;
209 default:
210 ret = mtd->read(mtd, *ppos, len, &retlen, kbuf);
212 /* Nand returns -EBADMSG on ecc errors, but it returns
213 * the data. For our userspace tools it is important
214 * to dump areas with ecc errors !
215 * For kernel internal usage it also might return -EUCLEAN
216 * to signal the caller that a bitflip has occured and has
217 * been corrected by the ECC algorithm.
218 * Userspace software which accesses NAND this way
219 * must be aware of the fact that it deals with NAND
221 if (!ret || (ret == -EUCLEAN) || (ret == -EBADMSG)) {
222 *ppos += retlen;
223 if (copy_to_user(buf, kbuf, retlen)) {
224 kfree(kbuf);
225 return -EFAULT;
227 else
228 total_retlen += retlen;
230 count -= retlen;
231 buf += retlen;
232 if (retlen == 0)
233 count = 0;
235 else {
236 kfree(kbuf);
237 return ret;
242 kfree(kbuf);
243 return total_retlen;
244 } /* mtd_read */
246 static ssize_t mtd_write(struct file *file, const char __user *buf, size_t count,loff_t *ppos)
248 struct mtd_file_info *mfi = file->private_data;
249 struct mtd_info *mtd = mfi->mtd;
250 char *kbuf;
251 size_t retlen;
252 size_t total_retlen=0;
253 int ret=0;
254 int len;
256 DEBUG(MTD_DEBUG_LEVEL0,"MTD_write\n");
258 if (*ppos == mtd->size)
259 return -ENOSPC;
261 if (*ppos + count > mtd->size)
262 count = mtd->size - *ppos;
264 if (!count)
265 return 0;
267 if (count > MAX_KMALLOC_SIZE)
268 kbuf=kmalloc(MAX_KMALLOC_SIZE, GFP_KERNEL);
269 else
270 kbuf=kmalloc(count, GFP_KERNEL);
272 if (!kbuf)
273 return -ENOMEM;
275 while (count) {
277 if (count > MAX_KMALLOC_SIZE)
278 len = MAX_KMALLOC_SIZE;
279 else
280 len = count;
282 if (copy_from_user(kbuf, buf, len)) {
283 kfree(kbuf);
284 return -EFAULT;
287 switch (mfi->mode) {
288 case MTD_MODE_OTP_FACTORY:
289 ret = -EROFS;
290 break;
291 case MTD_MODE_OTP_USER:
292 if (!mtd->write_user_prot_reg) {
293 ret = -EOPNOTSUPP;
294 break;
296 ret = mtd->write_user_prot_reg(mtd, *ppos, len, &retlen, kbuf);
297 break;
299 case MTD_MODE_RAW:
301 struct mtd_oob_ops ops;
303 ops.mode = MTD_OOB_RAW;
304 ops.datbuf = kbuf;
305 ops.oobbuf = NULL;
306 ops.len = len;
308 ret = mtd->write_oob(mtd, *ppos, &ops);
309 retlen = ops.retlen;
310 break;
313 default:
314 ret = (*(mtd->write))(mtd, *ppos, len, &retlen, kbuf);
316 if (!ret) {
317 *ppos += retlen;
318 total_retlen += retlen;
319 count -= retlen;
320 buf += retlen;
322 else {
323 kfree(kbuf);
324 return ret;
328 kfree(kbuf);
329 return total_retlen;
330 } /* mtd_write */
332 /*======================================================================
334 IOCTL calls for getting device parameters.
336 ======================================================================*/
337 static void mtdchar_erase_callback (struct erase_info *instr)
339 wake_up((wait_queue_head_t *)instr->priv);
342 #if defined(CONFIG_MTD_OTP) || defined(CONFIG_MTD_ONENAND_OTP)
343 static int otp_select_filemode(struct mtd_file_info *mfi, int mode)
345 struct mtd_info *mtd = mfi->mtd;
346 int ret = 0;
348 switch (mode) {
349 case MTD_OTP_FACTORY:
350 if (!mtd->read_fact_prot_reg)
351 ret = -EOPNOTSUPP;
352 else
353 mfi->mode = MTD_MODE_OTP_FACTORY;
354 break;
355 case MTD_OTP_USER:
356 if (!mtd->read_fact_prot_reg)
357 ret = -EOPNOTSUPP;
358 else
359 mfi->mode = MTD_MODE_OTP_USER;
360 break;
361 default:
362 ret = -EINVAL;
363 case MTD_OTP_OFF:
364 break;
366 return ret;
368 #else
369 # define otp_select_filemode(f,m) -EOPNOTSUPP
370 #endif
372 static int mtd_ioctl(struct inode *inode, struct file *file,
373 u_int cmd, u_long arg)
375 struct mtd_file_info *mfi = file->private_data;
376 struct mtd_info *mtd = mfi->mtd;
377 void __user *argp = (void __user *)arg;
378 int ret = 0;
379 u_long size;
380 struct mtd_info_user info;
382 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
384 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
385 if (cmd & IOC_IN) {
386 if (!access_ok(VERIFY_READ, argp, size))
387 return -EFAULT;
389 if (cmd & IOC_OUT) {
390 if (!access_ok(VERIFY_WRITE, argp, size))
391 return -EFAULT;
394 switch (cmd) {
395 case MEMGETREGIONCOUNT:
396 if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))
397 return -EFAULT;
398 break;
400 case MEMGETREGIONINFO:
402 struct region_info_user ur;
404 if (copy_from_user(&ur, argp, sizeof(struct region_info_user)))
405 return -EFAULT;
407 if (ur.regionindex >= mtd->numeraseregions)
408 return -EINVAL;
409 if (copy_to_user(argp, &(mtd->eraseregions[ur.regionindex]),
410 sizeof(struct mtd_erase_region_info)))
411 return -EFAULT;
412 break;
415 case MEMGETINFO:
416 info.type = mtd->type;
417 info.flags = mtd->flags;
418 info.size = mtd->size;
419 info.erasesize = mtd->erasesize;
420 info.writesize = mtd->writesize;
421 info.oobsize = mtd->oobsize;
422 /* The below fields are obsolete */
423 info.ecctype = -1;
424 info.eccsize = 0;
425 if (copy_to_user(argp, &info, sizeof(struct mtd_info_user)))
426 return -EFAULT;
427 break;
429 case MEMERASE:
431 struct erase_info *erase;
433 if(!(file->f_mode & 2))
434 return -EPERM;
436 erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
437 if (!erase)
438 ret = -ENOMEM;
439 else {
440 wait_queue_head_t waitq;
441 DECLARE_WAITQUEUE(wait, current);
443 init_waitqueue_head(&waitq);
445 if (copy_from_user(&erase->addr, argp,
446 sizeof(struct erase_info_user))) {
447 kfree(erase);
448 return -EFAULT;
450 erase->mtd = mtd;
451 erase->callback = mtdchar_erase_callback;
452 erase->priv = (unsigned long)&waitq;
455 FIXME: Allow INTERRUPTIBLE. Which means
456 not having the wait_queue head on the stack.
458 If the wq_head is on the stack, and we
459 leave because we got interrupted, then the
460 wq_head is no longer there when the
461 callback routine tries to wake us up.
463 ret = mtd->erase(mtd, erase);
464 if (!ret) {
465 set_current_state(TASK_UNINTERRUPTIBLE);
466 add_wait_queue(&waitq, &wait);
467 if (erase->state != MTD_ERASE_DONE &&
468 erase->state != MTD_ERASE_FAILED)
469 schedule();
470 remove_wait_queue(&waitq, &wait);
471 set_current_state(TASK_RUNNING);
473 ret = (erase->state == MTD_ERASE_FAILED)?-EIO:0;
475 kfree(erase);
477 break;
480 case MEMWRITEOOB:
482 struct mtd_oob_buf buf;
483 struct mtd_oob_ops ops;
485 if(!(file->f_mode & 2))
486 return -EPERM;
488 if (copy_from_user(&buf, argp, sizeof(struct mtd_oob_buf)))
489 return -EFAULT;
491 if (buf.length > 4096)
492 return -EINVAL;
494 if (!mtd->write_oob)
495 ret = -EOPNOTSUPP;
496 else
497 ret = access_ok(VERIFY_READ, buf.ptr,
498 buf.length) ? 0 : EFAULT;
500 if (ret)
501 return ret;
503 ops.ooblen = buf.length;
504 ops.ooboffs = buf.start & (mtd->oobsize - 1);
505 ops.datbuf = NULL;
506 ops.mode = MTD_OOB_PLACE;
508 if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
509 return -EINVAL;
511 ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);
512 if (!ops.oobbuf)
513 return -ENOMEM;
515 if (copy_from_user(ops.oobbuf, buf.ptr, buf.length)) {
516 kfree(ops.oobbuf);
517 return -EFAULT;
520 buf.start &= ~(mtd->oobsize - 1);
521 ret = mtd->write_oob(mtd, buf.start, &ops);
523 if (copy_to_user(argp + sizeof(uint32_t), &ops.oobretlen,
524 sizeof(uint32_t)))
525 ret = -EFAULT;
527 kfree(ops.oobbuf);
528 break;
532 case MEMREADOOB:
534 struct mtd_oob_buf buf;
535 struct mtd_oob_ops ops;
537 if (copy_from_user(&buf, argp, sizeof(struct mtd_oob_buf)))
538 return -EFAULT;
540 if (buf.length > 4096)
541 return -EINVAL;
543 if (!mtd->read_oob)
544 ret = -EOPNOTSUPP;
545 else
546 ret = access_ok(VERIFY_WRITE, buf.ptr,
547 buf.length) ? 0 : -EFAULT;
548 if (ret)
549 return ret;
551 ops.ooblen = buf.length;
552 ops.ooboffs = buf.start & (mtd->oobsize - 1);
553 ops.datbuf = NULL;
554 ops.mode = MTD_OOB_PLACE;
556 if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
557 return -EINVAL;
559 ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);
560 if (!ops.oobbuf)
561 return -ENOMEM;
563 buf.start &= ~(mtd->oobsize - 1);
564 ret = mtd->read_oob(mtd, buf.start, &ops);
566 if (put_user(ops.oobretlen, (uint32_t __user *)argp))
567 ret = -EFAULT;
568 else if (ops.oobretlen && copy_to_user(buf.ptr, ops.oobbuf,
569 ops.oobretlen))
570 ret = -EFAULT;
572 kfree(ops.oobbuf);
573 break;
576 case MEMLOCK:
578 struct erase_info_user info;
580 if (copy_from_user(&info, argp, sizeof(info)))
581 return -EFAULT;
583 if (!mtd->lock)
584 ret = -EOPNOTSUPP;
585 else
586 ret = mtd->lock(mtd, info.start, info.length);
587 break;
590 case MEMUNLOCK:
592 struct erase_info_user info;
594 if (copy_from_user(&info, argp, sizeof(info)))
595 return -EFAULT;
597 if (!mtd->unlock)
598 ret = -EOPNOTSUPP;
599 else
600 ret = mtd->unlock(mtd, info.start, info.length);
601 break;
604 /* Legacy interface */
605 case MEMGETOOBSEL:
607 struct nand_oobinfo oi;
609 if (!mtd->ecclayout)
610 return -EOPNOTSUPP;
611 if (mtd->ecclayout->eccbytes > ARRAY_SIZE(oi.eccpos))
612 return -EINVAL;
614 oi.useecc = MTD_NANDECC_AUTOPLACE;
615 memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos));
616 memcpy(&oi.oobfree, mtd->ecclayout->oobfree,
617 sizeof(oi.oobfree));
618 oi.eccbytes = mtd->ecclayout->eccbytes;
620 if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo)))
621 return -EFAULT;
622 break;
625 case MEMGETBADBLOCK:
627 loff_t offs;
629 if (copy_from_user(&offs, argp, sizeof(loff_t)))
630 return -EFAULT;
631 if (!mtd->block_isbad)
632 ret = -EOPNOTSUPP;
633 else
634 return mtd->block_isbad(mtd, offs);
635 break;
638 case MEMSETBADBLOCK:
640 loff_t offs;
642 if (copy_from_user(&offs, argp, sizeof(loff_t)))
643 return -EFAULT;
644 if (!mtd->block_markbad)
645 ret = -EOPNOTSUPP;
646 else
647 return mtd->block_markbad(mtd, offs);
648 break;
651 #if defined(CONFIG_MTD_OTP) || defined(CONFIG_MTD_ONENAND_OTP)
652 case OTPSELECT:
654 int mode;
655 if (copy_from_user(&mode, argp, sizeof(int)))
656 return -EFAULT;
658 mfi->mode = MTD_MODE_NORMAL;
660 ret = otp_select_filemode(mfi, mode);
662 file->f_pos = 0;
663 break;
666 case OTPGETREGIONCOUNT:
667 case OTPGETREGIONINFO:
669 struct otp_info *buf = kmalloc(4096, GFP_KERNEL);
670 if (!buf)
671 return -ENOMEM;
672 ret = -EOPNOTSUPP;
673 switch (mfi->mode) {
674 case MTD_MODE_OTP_FACTORY:
675 if (mtd->get_fact_prot_info)
676 ret = mtd->get_fact_prot_info(mtd, buf, 4096);
677 break;
678 case MTD_MODE_OTP_USER:
679 if (mtd->get_user_prot_info)
680 ret = mtd->get_user_prot_info(mtd, buf, 4096);
681 break;
682 default:
683 break;
685 if (ret >= 0) {
686 if (cmd == OTPGETREGIONCOUNT) {
687 int nbr = ret / sizeof(struct otp_info);
688 ret = copy_to_user(argp, &nbr, sizeof(int));
689 } else
690 ret = copy_to_user(argp, buf, ret);
691 if (ret)
692 ret = -EFAULT;
694 kfree(buf);
695 break;
698 case OTPLOCK:
700 struct otp_info info;
702 if (mfi->mode != MTD_MODE_OTP_USER)
703 return -EINVAL;
704 if (copy_from_user(&info, argp, sizeof(info)))
705 return -EFAULT;
706 if (!mtd->lock_user_prot_reg)
707 return -EOPNOTSUPP;
708 ret = mtd->lock_user_prot_reg(mtd, info.start, info.length);
709 break;
711 #endif
713 case ECCGETLAYOUT:
715 if (!mtd->ecclayout)
716 return -EOPNOTSUPP;
718 if (copy_to_user(argp, mtd->ecclayout,
719 sizeof(struct nand_ecclayout)))
720 return -EFAULT;
721 break;
724 case ECCGETSTATS:
726 if (copy_to_user(argp, &mtd->ecc_stats,
727 sizeof(struct mtd_ecc_stats)))
728 return -EFAULT;
729 break;
732 case MTDFILEMODE:
734 mfi->mode = 0;
736 switch(arg) {
737 case MTD_MODE_OTP_FACTORY:
738 case MTD_MODE_OTP_USER:
739 ret = otp_select_filemode(mfi, arg);
740 break;
742 case MTD_MODE_RAW:
743 if (!mtd->read_oob || !mtd->write_oob)
744 return -EOPNOTSUPP;
745 mfi->mode = arg;
747 case MTD_MODE_NORMAL:
748 break;
749 default:
750 ret = -EINVAL;
752 file->f_pos = 0;
753 break;
756 default:
757 ret = -ENOTTY;
760 return ret;
761 } /* memory_ioctl */
763 static const struct file_operations mtd_fops = {
764 .owner = THIS_MODULE,
765 .llseek = mtd_lseek,
766 .read = mtd_read,
767 .write = mtd_write,
768 .ioctl = mtd_ioctl,
769 .open = mtd_open,
770 .release = mtd_close,
773 static int __init init_mtdchar(void)
775 if (register_chrdev(MTD_CHAR_MAJOR, "mtd", &mtd_fops)) {
776 printk(KERN_NOTICE "Can't allocate major number %d for Memory Technology Devices.\n",
777 MTD_CHAR_MAJOR);
778 return -EAGAIN;
781 mtd_class = class_create(THIS_MODULE, "mtd");
783 if (IS_ERR(mtd_class)) {
784 printk(KERN_ERR "Error creating mtd class.\n");
785 unregister_chrdev(MTD_CHAR_MAJOR, "mtd");
786 return PTR_ERR(mtd_class);
789 register_mtd_user(&notifier);
790 return 0;
793 static void __exit cleanup_mtdchar(void)
795 unregister_mtd_user(&notifier);
796 class_destroy(mtd_class);
797 unregister_chrdev(MTD_CHAR_MAJOR, "mtd");
800 module_init(init_mtdchar);
801 module_exit(cleanup_mtdchar);
804 MODULE_LICENSE("GPL");
805 MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
806 MODULE_DESCRIPTION("Direct character-device access to MTD devices");