The MEMGETREGIONINFO ioctl() in mtdchar.c was clobbering user memory by
overwriting more than intended, due the size of struct mtd_erase_region_info
changing in commit 0ecbc81a ('Support
for auto locking flash on power up').

Fix avoids this by copying struct members one by one with put_user(), as there
is no longer a convenient struct to use the size of as the length argument to
copy_to_user().
Signed-off-by: NZev Weiss <zevweiss@gmail.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

device_create() is race-prone, so use the race-free
device_create_drvdata() instead as device_create() is going away.

Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use einfo, oinfo for the inner erase_info and otp_info structs used in
individual case statements.

drivers/mtd/mtdchar.c:582:26: warning: symbol 'info' shadows an earlier one
drivers/mtd/mtdchar.c:380:23: originally declared here
drivers/mtd/mtdchar.c:596:26: warning: symbol 'info' shadows an earlier one
drivers/mtd/mtdchar.c:380:23: originally declared here
drivers/mtd/mtdchar.c:704:19: warning: symbol 'info' shadows an earlier one
drivers/mtd/mtdchar.c:380:23: originally declared here
Signed-off-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

The copy_to_user was casting away the address space to get the offset of
the length member.  Use offsetof() instead and add it to the void __user
*argp.

drivers/mtd/mtdchar.c:527:23: warning: cast removes address space of expression
drivers/mtd/mtdchar.c:527:23: warning: incorrect type in argument 1 (different address spaces)
drivers/mtd/mtdchar.c:527:23:    expected void [noderef] <asn:1>*to
drivers/mtd/mtdchar.c:527:23:    got unsigned int *<noident>
Signed-off-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Signed-off-by: NJonathan Corbet <corbet@lwn.net>

Once upon a time, the MTD repository was using CVS.

This patch therefore removes all usages of the no longer updated CVS
keywords from the MTD code.

This also includes code that printed them to the user.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

struct class_device is going away, this converts the code to use struct
device instead.
Signed-off-by: NTony Jones <tonyj@suse.de>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

"include/linux/mtd/mtd.h" declares "mtd_oob_ops.retlen" as size_t, which
is 64 bits on targets with a 64 bit addressing. The MEMWRITEOOB ioctl
calls copy_to_user() to write it back to "mtd_oob_buf.length", which is
declared in "include/linux/mtd-abi.h" as uint32_t. Since powerpc is a
big endian architecture, this only copies the upper 32 bits of the
address, which is always 0.
Signed-off-by: NDavid Scidmore <dscidmore@xes-inc.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

sh:

drivers/mtd/mtdchar.c: In function `mtd_mmap':
drivers/mtd/mtdchar.c:817: error: dereferencing pointer to incomplete type
drivers/mtd/mtdchar.c:817: error: `VM_SHARED' undeclared (first use in this function)
drivers/mtd/mtdchar.c:817: error: (Each undeclared identifier is reported only once

Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

The ops.len member is not initialized, because it is unused for this
operation. The length check needs to use ops.ooblen instead
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Many struct file_operations in the kernel can be "const".  Marking them const
moves these to the .rodata section, which avoids false sharing with potential
dirty data.  In addition it'll catch accidental writes at compile time to
these shared resources.
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove unused and broken mtd->ecctype and mtd->eccsize fields
from struct mtd_info. Do not remove them from userspace API
data structures (don't want to breake userspace) but mark them
as obsolete by a comment. Any userspace program which uses them
should be half-broken anyway, so this is more about saving
data structure size.
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

get_mtd_device() returns NULL in case of any failure. Teach it to return an
error code instead. Fix all users as well.
Signed-off-by: NArtem Bityutskiy <dedekind@infradead.org>

Signed-off-by: NYan Burman <yan_952@hotmail.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

As was discussed between Ricard Wanderlöf, David Woodhouse, Artem 
Bityutskiy and me, the current API for reading/writing OOB is confusing. 

The thing that introduces confusion is the need to specify ops.len 
together with ops.ooblen for reads/writes that concern only OOB not data 
area. So, ops.len is overloaded: when ops.datbuf != NULL it serves to 
specify the length of the data read, and when ops.datbuf == NULL, it 
serves to specify the full OOB read length.

The patch inlined below is the slightly updated version of the previous 
patch serving the same purpose, but with the new Artem's comments taken 
into account.

Artem, BTW, thanks a lot for your valuable input!
Signed-off-by: NVitaly Wool <vwool@ru.mvista.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

1. The ECCGETLAYOUT ioctl copy_to_user() call has a superfluous '&'
causing the resulting information to be garbage rather than the intended
mtd->ecclayout.

2. The MEMGETOOBSEL misses copying mtd->ecclayout->eccbytes so the
resulting field of the returned structure contains garbage.
Signed-off-by: NRicard Wanderlöf <ricardw@axis.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Signed-off-by: NJosef 'Jeff' Sipek <jeffpc@josefsipek.net>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Signed-off-by: NJörn Engel <joern@wohnheim.fh-wedel.de>
Signed-off-by: NAdrian Bunk <bunk@stusta.de>

Allow lseek(mtdchar_fd, 0, SEEK_END) to succeed, which currently fails
with EINVAL.

lseek(fd, 0, SEEK_END) should result into the same fileposition as
lseek(fd, 0, SEEK_SET) + read(fd, buf, length(fd))

Furthermore, lseek(fd, 0, SEEK_CUR) should return the current file position,
which in case of an encountered EOF should not result in EINVAL
Signed-off-by: NHerbert Valerio Riedel <hvr@gnu.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Following problems are addressed:

- wrong status caused early break out of nand_wait()
- removed the bogus status check in nand_wait() which
  is a relict of the abandoned support for interrupted
  erase.
- status check moved to the correct place in read_oob
- oob support for syndrom based ecc with strange layouts
- use given offset in the AUTOOOB based oob operations

Partially based on a patch from Vitaly Vool <vwool@ru.mvista.com>
Thanks to Savin Zlobec <savin@epico.si> for tracking down the
status problem.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

mtdchar.c direcly copied part of struct mtd_info to userspace, thereby
implicitly making it part of the ABI.  With this patch, struct
mtd_info is independent of the ABI and can have its fields removed,
reordered, etc.
Signed-off-by: NJoern Engel <joern@wh.fh-wedel.de>

The raw read/write access to NAND (without ECC) has been changed in the
NAND rework. Expose the new way - setting the file mode via ioctl - to
userspace. Also allow to read out the ecc statistics information so userspace
tools can see that bitflips happened and whether errors where correctable
or not. Also expose the number of bad blocks for the partition, so nandwrite
can check if the data fits into the parition before writing to it.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Return -EUCLEAN on read when a bitflip was detected and corrected, so the
clients can react and eventually copy the affected block to a spare one.
Make all in kernel users aware of the change.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Hopefully the last iteration on this!

The handling of out of band data on NAND was accompanied by tons of fruitless
discussions and halfarsed patches to make it work for a particular
problem. Sufficiently annoyed by I all those "I know it better" mails and the
resonable amount of discarded "it solves my problem" patches, I finally decided
to go for the big rework. After removing the _ecc variants of mtd read/write
functions the solution to satisfy the various requirements was to refactor the
read/write _oob functions in mtd.

The major change is that read/write_oob now takes a pointer to an operation
descriptor structure "struct mtd_oob_ops".instead of having a function with at
least seven arguments.

read/write_oob which should probably renamed to a more descriptive name, can do
the following tasks:

- read/write out of band data
- read/write data content and out of band data
- read/write raw data content and out of band data (ecc disabled)

struct mtd_oob_ops has a mode field, which determines the oob handling mode.

Aside of the MTD_OOB_RAW mode, which is intended to be especially for
diagnostic purposes and some internal functions e.g. bad block table creation,
the other two modes are for mtd clients:

MTD_OOB_PLACE puts/gets the given oob data exactly to/from the place which is
described by the ooboffs and ooblen fields of the mtd_oob_ops strcuture. It's
up to the caller to make sure that the byte positions are not used by the ECC
placement algorithms.

MTD_OOB_AUTO puts/gets the given oob data automaticaly to/from the places in
the out of band area which are described by the oobfree tuples in the ecclayout
data structre which is associated to the devicee.

The decision whether data plus oob or oob only handling is done depends on the
setting of the datbuf member of the data structure. When datbuf == NULL then
the internal read/write_oob functions are selected, otherwise the read/write
data routines are invoked.

Tested on a few platforms with all variants. Please be aware of possible
regressions for your particular device / application scenario

Disclaimer: Any whining will be ignored from those who just contributed "hot
air blurb" and never sat down to tackle the underlying problem of the mess in
the NAND driver grown over time and the big chunk of work to fix up the
existing users. The problem was not the holiness of the existing MTD
interfaces. The problems was the lack of time to go for the big overhaul. It's
easy to add more mess to the existing one, but it takes alot of effort to go
for a real solution.

Improvements and bugfixes are welcome!
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Most of those macros are unused and the used ones just obfuscate
the code. Remove them and fixup all users.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

The nand_oobinfo structure is not fitting the newer error correction
demands anymore. Replace it by struct nand_ecclayout and fixup the users
all over the place. Keep the nand_oobinfo based ioctl for user space
compability reasons.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

The info structure for out of band data was copied into
the mtd structure. Make it a pointer and remove the ability
to set it from userspace. The position of ecc bytes is
defined by the hardware and should not be changed by software.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

One Block of the NAND Flash Array memory is reserved as
a One-Time Programmable Block memory area.
Also, 1st Block of NAND Flash Array can be used as OTP.

The OTP block can be read, programmed and locked using the same
operations as any other NAND Flash Array memory block.
OTP block cannot be erased.

OTP block is fully-guaranteed to be a valid block.
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>

This patch removes repeated calls to kmalloc / kfree in mtd_write /
mtd_read functions, replacing them by a single kmalloc / kfree pair.
Signed-off-by: NThiago Galesi <thiagogalesi@gmail.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

While we are at it, reorder the includes and
remove the silly /* TASK */ comment
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

I recently picked up my older work to remove unnecessary #includes of
sched.h, starting from a patch by Dave Jones to not include sched.h
from module.h. This reduces the number of indirect includes of sched.h
by ~300. Another ~400 pointless direct includes can be removed after
this disentangling (patch to follow later).
However, quite a few indirect includes need to be fixed up for this.

In order to feed the patches through -mm with as little disturbance as
possible, I've split out the fixes I accumulated up to now (complete for
i386 and x86_64, more archs to follow later) and post them before the real
patch.  This way this large part of the patch is kept simple with only
adding #includes, and all hunks are independent of each other.  So if any
hunk rejects or gets in the way of other patches, just drop it.  My scripts
will pick it up again in the next round.
Signed-off-by: NTim Schmielau <tim@physik3.uni-rostock.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The previous patch adding the ability to nest struct class_device
changed the paramaters to the call class_device_create().  This patch
fixes up all in-kernel users of the function.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

mtdchar return -EINVAL for seek prior to offset 0 or to beyond the last
byte in the device/partition, similar to various other seek methods,
instead of fixing up to first or last byte.
Signed-off-by: NTodd Poynor <tpoynor@mvista.com>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Signed-off-by: NCoywolf Qi Hunt <coywolf@sosdg.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Switch from DEVFS to udev for dynamic creation of device nodes for mtd
char devices.

Creates a new LDM class "mtd" with writeable and read-only devices
registered for each mtdchar device.

From: Paolo Galtieri <pgaltieri@mvista.com>
Signed-off-by: NTodd Poynor <tpoynor@mvista.com>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Signed-off-by: NNicolas Pitre <nico@cam.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

Signed-off-by: NNicolas Pitre <nico@cam.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>

This is implemented using a ioctl to switch the MTD char device into
one of the different OTP "modes", at which point read/write/seek can
operate on the selected OTP area.  Also some extra ioctls to query
for size and lock protection segments or groups.  Some example user
space utilities are provided.
Signed-off-by: NNicolas Pitre <nico@cam.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>