i2c-dev: Reject I2C_M_RECV_LEN
[safe/jmp/linux-2.6] / drivers / i2c / i2c-dev.c
1 /*
2     i2c-dev.c - i2c-bus driver, char device interface
3
4     Copyright (C) 1995-97 Simon G. Vogl
5     Copyright (C) 1998-99 Frodo Looijaard <frodol@dds.nl>
6     Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
7
8     This program is free software; you can redistribute it and/or modify
9     it under the terms of the GNU General Public License as published by
10     the Free Software Foundation; either version 2 of the License, or
11     (at your option) any later version.
12
13     This program is distributed in the hope that it will be useful,
14     but WITHOUT ANY WARRANTY; without even the implied warranty of
15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16     GNU General Public License for more details.
17
18     You should have received a copy of the GNU General Public License
19     along with this program; if not, write to the Free Software
20     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22
23 /* Note that this is a complete rewrite of Simon Vogl's i2c-dev module.
24    But I have used so much of his original code and ideas that it seems
25    only fair to recognize him as co-author -- Frodo */
26
27 /* The I2C_RDWR ioctl code is written by Kolja Waschk <waschk@telos.de> */
28
29 #include <linux/kernel.h>
30 #include <linux/module.h>
31 #include <linux/fs.h>
32 #include <linux/slab.h>
33 #include <linux/init.h>
34 #include <linux/list.h>
35 #include <linux/i2c.h>
36 #include <linux/i2c-dev.h>
37 #include <asm/uaccess.h>
38
39 static struct i2c_driver i2cdev_driver;
40
41 struct i2c_dev {
42         struct list_head list;
43         struct i2c_adapter *adap;
44         struct device *dev;
45 };
46
47 #define I2C_MINORS      256
48 static LIST_HEAD(i2c_dev_list);
49 static DEFINE_SPINLOCK(i2c_dev_list_lock);
50
51 static struct i2c_dev *i2c_dev_get_by_minor(unsigned index)
52 {
53         struct i2c_dev *i2c_dev;
54
55         spin_lock(&i2c_dev_list_lock);
56         list_for_each_entry(i2c_dev, &i2c_dev_list, list) {
57                 if (i2c_dev->adap->nr == index)
58                         goto found;
59         }
60         i2c_dev = NULL;
61 found:
62         spin_unlock(&i2c_dev_list_lock);
63         return i2c_dev;
64 }
65
66 static struct i2c_dev *get_free_i2c_dev(struct i2c_adapter *adap)
67 {
68         struct i2c_dev *i2c_dev;
69
70         if (adap->nr >= I2C_MINORS) {
71                 printk(KERN_ERR "i2c-dev: Out of device minors (%d)\n",
72                        adap->nr);
73                 return ERR_PTR(-ENODEV);
74         }
75
76         i2c_dev = kzalloc(sizeof(*i2c_dev), GFP_KERNEL);
77         if (!i2c_dev)
78                 return ERR_PTR(-ENOMEM);
79         i2c_dev->adap = adap;
80
81         spin_lock(&i2c_dev_list_lock);
82         list_add_tail(&i2c_dev->list, &i2c_dev_list);
83         spin_unlock(&i2c_dev_list_lock);
84         return i2c_dev;
85 }
86
87 static void return_i2c_dev(struct i2c_dev *i2c_dev)
88 {
89         spin_lock(&i2c_dev_list_lock);
90         list_del(&i2c_dev->list);
91         spin_unlock(&i2c_dev_list_lock);
92         kfree(i2c_dev);
93 }
94
95 static ssize_t show_adapter_name(struct device *dev,
96                                  struct device_attribute *attr, char *buf)
97 {
98         struct i2c_dev *i2c_dev = i2c_dev_get_by_minor(MINOR(dev->devt));
99
100         if (!i2c_dev)
101                 return -ENODEV;
102         return sprintf(buf, "%s\n", i2c_dev->adap->name);
103 }
104 static DEVICE_ATTR(name, S_IRUGO, show_adapter_name, NULL);
105
106 static ssize_t i2cdev_read (struct file *file, char __user *buf, size_t count,
107                             loff_t *offset)
108 {
109         char *tmp;
110         int ret;
111
112         struct i2c_client *client = (struct i2c_client *)file->private_data;
113
114         if (count > 8192)
115                 count = 8192;
116
117         tmp = kmalloc(count,GFP_KERNEL);
118         if (tmp==NULL)
119                 return -ENOMEM;
120
121         pr_debug("i2c-dev: i2c-%d reading %zd bytes.\n",
122                 iminor(file->f_path.dentry->d_inode), count);
123
124         ret = i2c_master_recv(client,tmp,count);
125         if (ret >= 0)
126                 ret = copy_to_user(buf,tmp,count)?-EFAULT:ret;
127         kfree(tmp);
128         return ret;
129 }
130
131 static ssize_t i2cdev_write (struct file *file, const char __user *buf, size_t count,
132                              loff_t *offset)
133 {
134         int ret;
135         char *tmp;
136         struct i2c_client *client = (struct i2c_client *)file->private_data;
137
138         if (count > 8192)
139                 count = 8192;
140
141         tmp = kmalloc(count,GFP_KERNEL);
142         if (tmp==NULL)
143                 return -ENOMEM;
144         if (copy_from_user(tmp,buf,count)) {
145                 kfree(tmp);
146                 return -EFAULT;
147         }
148
149         pr_debug("i2c-dev: i2c-%d writing %zd bytes.\n",
150                 iminor(file->f_path.dentry->d_inode), count);
151
152         ret = i2c_master_send(client,tmp,count);
153         kfree(tmp);
154         return ret;
155 }
156
157 static int i2cdev_ioctl(struct inode *inode, struct file *file,
158                 unsigned int cmd, unsigned long arg)
159 {
160         struct i2c_client *client = (struct i2c_client *)file->private_data;
161         struct i2c_rdwr_ioctl_data rdwr_arg;
162         struct i2c_smbus_ioctl_data data_arg;
163         union i2c_smbus_data temp;
164         struct i2c_msg *rdwr_pa;
165         u8 __user **data_ptrs;
166         int i,datasize,res;
167         unsigned long funcs;
168
169         dev_dbg(&client->adapter->dev, "ioctl, cmd=0x%02x, arg=0x%02lx\n",
170                 cmd, arg);
171
172         switch ( cmd ) {
173         case I2C_SLAVE:
174         case I2C_SLAVE_FORCE:
175                 if ((arg > 0x3ff) ||
176                     (((client->flags & I2C_M_TEN) == 0) && arg > 0x7f))
177                         return -EINVAL;
178                 if ((cmd == I2C_SLAVE) && i2c_check_addr(client->adapter,arg))
179                         return -EBUSY;
180                 client->addr = arg;
181                 return 0;
182         case I2C_TENBIT:
183                 if (arg)
184                         client->flags |= I2C_M_TEN;
185                 else
186                         client->flags &= ~I2C_M_TEN;
187                 return 0;
188         case I2C_PEC:
189                 if (arg)
190                         client->flags |= I2C_CLIENT_PEC;
191                 else
192                         client->flags &= ~I2C_CLIENT_PEC;
193                 return 0;
194         case I2C_FUNCS:
195                 funcs = i2c_get_functionality(client->adapter);
196                 return put_user(funcs, (unsigned long __user *)arg);
197
198         case I2C_RDWR:
199                 if (copy_from_user(&rdwr_arg,
200                                    (struct i2c_rdwr_ioctl_data __user *)arg,
201                                    sizeof(rdwr_arg)))
202                         return -EFAULT;
203
204                 /* Put an arbitrary limit on the number of messages that can
205                  * be sent at once */
206                 if (rdwr_arg.nmsgs > I2C_RDRW_IOCTL_MAX_MSGS)
207                         return -EINVAL;
208
209                 rdwr_pa = (struct i2c_msg *)
210                         kmalloc(rdwr_arg.nmsgs * sizeof(struct i2c_msg),
211                         GFP_KERNEL);
212
213                 if (rdwr_pa == NULL) return -ENOMEM;
214
215                 if (copy_from_user(rdwr_pa, rdwr_arg.msgs,
216                                    rdwr_arg.nmsgs * sizeof(struct i2c_msg))) {
217                         kfree(rdwr_pa);
218                         return -EFAULT;
219                 }
220
221                 data_ptrs = kmalloc(rdwr_arg.nmsgs * sizeof(u8 __user *), GFP_KERNEL);
222                 if (data_ptrs == NULL) {
223                         kfree(rdwr_pa);
224                         return -ENOMEM;
225                 }
226
227                 res = 0;
228                 for( i=0; i<rdwr_arg.nmsgs; i++ ) {
229                         /* Limit the size of the message to a sane amount;
230                          * and don't let length change either. */
231                         if ((rdwr_pa[i].len > 8192) ||
232                             (rdwr_pa[i].flags & I2C_M_RECV_LEN)) {
233                                 res = -EINVAL;
234                                 break;
235                         }
236                         data_ptrs[i] = (u8 __user *)rdwr_pa[i].buf;
237                         rdwr_pa[i].buf = kmalloc(rdwr_pa[i].len, GFP_KERNEL);
238                         if(rdwr_pa[i].buf == NULL) {
239                                 res = -ENOMEM;
240                                 break;
241                         }
242                         if(copy_from_user(rdwr_pa[i].buf,
243                                 data_ptrs[i],
244                                 rdwr_pa[i].len)) {
245                                         ++i; /* Needs to be kfreed too */
246                                         res = -EFAULT;
247                                 break;
248                         }
249                 }
250                 if (res < 0) {
251                         int j;
252                         for (j = 0; j < i; ++j)
253                                 kfree(rdwr_pa[j].buf);
254                         kfree(data_ptrs);
255                         kfree(rdwr_pa);
256                         return res;
257                 }
258
259                 res = i2c_transfer(client->adapter,
260                         rdwr_pa,
261                         rdwr_arg.nmsgs);
262                 while(i-- > 0) {
263                         if( res>=0 && (rdwr_pa[i].flags & I2C_M_RD)) {
264                                 if(copy_to_user(
265                                         data_ptrs[i],
266                                         rdwr_pa[i].buf,
267                                         rdwr_pa[i].len)) {
268                                         res = -EFAULT;
269                                 }
270                         }
271                         kfree(rdwr_pa[i].buf);
272                 }
273                 kfree(data_ptrs);
274                 kfree(rdwr_pa);
275                 return res;
276
277         case I2C_SMBUS:
278                 if (copy_from_user(&data_arg,
279                                    (struct i2c_smbus_ioctl_data __user *) arg,
280                                    sizeof(struct i2c_smbus_ioctl_data)))
281                         return -EFAULT;
282                 if ((data_arg.size != I2C_SMBUS_BYTE) &&
283                     (data_arg.size != I2C_SMBUS_QUICK) &&
284                     (data_arg.size != I2C_SMBUS_BYTE_DATA) &&
285                     (data_arg.size != I2C_SMBUS_WORD_DATA) &&
286                     (data_arg.size != I2C_SMBUS_PROC_CALL) &&
287                     (data_arg.size != I2C_SMBUS_BLOCK_DATA) &&
288                     (data_arg.size != I2C_SMBUS_I2C_BLOCK_BROKEN) &&
289                     (data_arg.size != I2C_SMBUS_I2C_BLOCK_DATA) &&
290                     (data_arg.size != I2C_SMBUS_BLOCK_PROC_CALL)) {
291                         dev_dbg(&client->adapter->dev,
292                                 "size out of range (%x) in ioctl I2C_SMBUS.\n",
293                                 data_arg.size);
294                         return -EINVAL;
295                 }
296                 /* Note that I2C_SMBUS_READ and I2C_SMBUS_WRITE are 0 and 1,
297                    so the check is valid if size==I2C_SMBUS_QUICK too. */
298                 if ((data_arg.read_write != I2C_SMBUS_READ) &&
299                     (data_arg.read_write != I2C_SMBUS_WRITE)) {
300                         dev_dbg(&client->adapter->dev,
301                                 "read_write out of range (%x) in ioctl I2C_SMBUS.\n",
302                                 data_arg.read_write);
303                         return -EINVAL;
304                 }
305
306                 /* Note that command values are always valid! */
307
308                 if ((data_arg.size == I2C_SMBUS_QUICK) ||
309                     ((data_arg.size == I2C_SMBUS_BYTE) &&
310                     (data_arg.read_write == I2C_SMBUS_WRITE)))
311                         /* These are special: we do not use data */
312                         return i2c_smbus_xfer(client->adapter, client->addr,
313                                               client->flags,
314                                               data_arg.read_write,
315                                               data_arg.command,
316                                               data_arg.size, NULL);
317
318                 if (data_arg.data == NULL) {
319                         dev_dbg(&client->adapter->dev,
320                                 "data is NULL pointer in ioctl I2C_SMBUS.\n");
321                         return -EINVAL;
322                 }
323
324                 if ((data_arg.size == I2C_SMBUS_BYTE_DATA) ||
325                     (data_arg.size == I2C_SMBUS_BYTE))
326                         datasize = sizeof(data_arg.data->byte);
327                 else if ((data_arg.size == I2C_SMBUS_WORD_DATA) ||
328                          (data_arg.size == I2C_SMBUS_PROC_CALL))
329                         datasize = sizeof(data_arg.data->word);
330                 else /* size == smbus block, i2c block, or block proc. call */
331                         datasize = sizeof(data_arg.data->block);
332
333                 if ((data_arg.size == I2C_SMBUS_PROC_CALL) ||
334                     (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||
335                     (data_arg.size == I2C_SMBUS_I2C_BLOCK_DATA) ||
336                     (data_arg.read_write == I2C_SMBUS_WRITE)) {
337                         if (copy_from_user(&temp, data_arg.data, datasize))
338                                 return -EFAULT;
339                 }
340                 if (data_arg.size == I2C_SMBUS_I2C_BLOCK_BROKEN) {
341                         /* Convert old I2C block commands to the new
342                            convention. This preserves binary compatibility. */
343                         data_arg.size = I2C_SMBUS_I2C_BLOCK_DATA;
344                         if (data_arg.read_write == I2C_SMBUS_READ)
345                                 temp.block[0] = I2C_SMBUS_BLOCK_MAX;
346                 }
347                 res = i2c_smbus_xfer(client->adapter,client->addr,client->flags,
348                       data_arg.read_write,
349                       data_arg.command,data_arg.size,&temp);
350                 if (! res && ((data_arg.size == I2C_SMBUS_PROC_CALL) ||
351                               (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||
352                               (data_arg.read_write == I2C_SMBUS_READ))) {
353                         if (copy_to_user(data_arg.data, &temp, datasize))
354                                 return -EFAULT;
355                 }
356                 return res;
357
358         default:
359                 return i2c_control(client,cmd,arg);
360         }
361         return 0;
362 }
363
364 static int i2cdev_open(struct inode *inode, struct file *file)
365 {
366         unsigned int minor = iminor(inode);
367         struct i2c_client *client;
368         struct i2c_adapter *adap;
369         struct i2c_dev *i2c_dev;
370
371         i2c_dev = i2c_dev_get_by_minor(minor);
372         if (!i2c_dev)
373                 return -ENODEV;
374
375         adap = i2c_get_adapter(i2c_dev->adap->nr);
376         if (!adap)
377                 return -ENODEV;
378
379         client = kzalloc(sizeof(*client), GFP_KERNEL);
380         if (!client) {
381                 i2c_put_adapter(adap);
382                 return -ENOMEM;
383         }
384         snprintf(client->name, I2C_NAME_SIZE, "i2c-dev %d", adap->nr);
385         client->driver = &i2cdev_driver;
386
387         /* registered with adapter, passed as client to user */
388         client->adapter = adap;
389         file->private_data = client;
390
391         return 0;
392 }
393
394 static int i2cdev_release(struct inode *inode, struct file *file)
395 {
396         struct i2c_client *client = file->private_data;
397
398         i2c_put_adapter(client->adapter);
399         kfree(client);
400         file->private_data = NULL;
401
402         return 0;
403 }
404
405 static const struct file_operations i2cdev_fops = {
406         .owner          = THIS_MODULE,
407         .llseek         = no_llseek,
408         .read           = i2cdev_read,
409         .write          = i2cdev_write,
410         .ioctl          = i2cdev_ioctl,
411         .open           = i2cdev_open,
412         .release        = i2cdev_release,
413 };
414
415 static struct class *i2c_dev_class;
416
417 static int i2cdev_attach_adapter(struct i2c_adapter *adap)
418 {
419         struct i2c_dev *i2c_dev;
420         int res;
421
422         i2c_dev = get_free_i2c_dev(adap);
423         if (IS_ERR(i2c_dev))
424                 return PTR_ERR(i2c_dev);
425
426         /* register this i2c device with the driver core */
427         i2c_dev->dev = device_create(i2c_dev_class, &adap->dev,
428                                      MKDEV(I2C_MAJOR, adap->nr),
429                                      "i2c-%d", adap->nr);
430         if (IS_ERR(i2c_dev->dev)) {
431                 res = PTR_ERR(i2c_dev->dev);
432                 goto error;
433         }
434         res = device_create_file(i2c_dev->dev, &dev_attr_name);
435         if (res)
436                 goto error_destroy;
437
438         pr_debug("i2c-dev: adapter [%s] registered as minor %d\n",
439                  adap->name, adap->nr);
440         return 0;
441 error_destroy:
442         device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));
443 error:
444         return_i2c_dev(i2c_dev);
445         return res;
446 }
447
448 static int i2cdev_detach_adapter(struct i2c_adapter *adap)
449 {
450         struct i2c_dev *i2c_dev;
451
452         i2c_dev = i2c_dev_get_by_minor(adap->nr);
453         if (!i2c_dev) /* attach_adapter must have failed */
454                 return 0;
455
456         device_remove_file(i2c_dev->dev, &dev_attr_name);
457         return_i2c_dev(i2c_dev);
458         device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));
459
460         pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name);
461         return 0;
462 }
463
464 static int i2cdev_detach_client(struct i2c_client *client)
465 {
466         return 0;
467 }
468
469 static struct i2c_driver i2cdev_driver = {
470         .driver = {
471                 .name   = "dev_driver",
472         },
473         .id             = I2C_DRIVERID_I2CDEV,
474         .attach_adapter = i2cdev_attach_adapter,
475         .detach_adapter = i2cdev_detach_adapter,
476         .detach_client  = i2cdev_detach_client,
477 };
478
479 static int __init i2c_dev_init(void)
480 {
481         int res;
482
483         printk(KERN_INFO "i2c /dev entries driver\n");
484
485         res = register_chrdev(I2C_MAJOR, "i2c", &i2cdev_fops);
486         if (res)
487                 goto out;
488
489         i2c_dev_class = class_create(THIS_MODULE, "i2c-dev");
490         if (IS_ERR(i2c_dev_class))
491                 goto out_unreg_chrdev;
492
493         res = i2c_add_driver(&i2cdev_driver);
494         if (res)
495                 goto out_unreg_class;
496
497         return 0;
498
499 out_unreg_class:
500         class_destroy(i2c_dev_class);
501 out_unreg_chrdev:
502         unregister_chrdev(I2C_MAJOR, "i2c");
503 out:
504         printk(KERN_ERR "%s: Driver Initialisation failed\n", __FILE__);
505         return res;
506 }
507
508 static void __exit i2c_dev_exit(void)
509 {
510         i2c_del_driver(&i2cdev_driver);
511         class_destroy(i2c_dev_class);
512         unregister_chrdev(I2C_MAJOR,"i2c");
513 }
514
515 MODULE_AUTHOR("Frodo Looijaard <frodol@dds.nl> and "
516                 "Simon G. Vogl <simon@tk.uni-linz.ac.at>");
517 MODULE_DESCRIPTION("I2C /dev entries driver");
518 MODULE_LICENSE("GPL");
519
520 module_init(i2c_dev_init);
521 module_exit(i2c_dev_exit);