ide: fix races in handling of user-space SET XFER commands
[safe/jmp/linux-2.6] / drivers / ide / ide-proc.c
1 /*
2  *  Copyright (C) 1997-1998     Mark Lord
3  *  Copyright (C) 2003          Red Hat
4  *
5  *  Some code was moved here from ide.c, see it for original copyrights.
6  */
7
8 /*
9  * This is the /proc/ide/ filesystem implementation.
10  *
11  * Drive/Driver settings can be retrieved by reading the drive's
12  * "settings" files.  e.g.    "cat /proc/ide0/hda/settings"
13  * To write a new value "val" into a specific setting "name", use:
14  *   echo "name:val" >/proc/ide/ide0/hda/settings
15  */
16
17 #include <linux/module.h>
18
19 #include <asm/uaccess.h>
20 #include <linux/errno.h>
21 #include <linux/proc_fs.h>
22 #include <linux/stat.h>
23 #include <linux/mm.h>
24 #include <linux/pci.h>
25 #include <linux/ctype.h>
26 #include <linux/ide.h>
27 #include <linux/seq_file.h>
28
29 #include <asm/io.h>
30
31 static struct proc_dir_entry *proc_ide_root;
32
33 static int proc_ide_read_imodel
34         (char *page, char **start, off_t off, int count, int *eof, void *data)
35 {
36         ide_hwif_t      *hwif = (ide_hwif_t *) data;
37         int             len;
38         const char      *name;
39
40         switch (hwif->chipset) {
41         case ide_generic:       name = "generic";       break;
42         case ide_pci:           name = "pci";           break;
43         case ide_cmd640:        name = "cmd640";        break;
44         case ide_dtc2278:       name = "dtc2278";       break;
45         case ide_ali14xx:       name = "ali14xx";       break;
46         case ide_qd65xx:        name = "qd65xx";        break;
47         case ide_umc8672:       name = "umc8672";       break;
48         case ide_ht6560b:       name = "ht6560b";       break;
49         case ide_4drives:       name = "4drives";       break;
50         case ide_pmac:          name = "mac-io";        break;
51         case ide_au1xxx:        name = "au1xxx";        break;
52         case ide_palm3710:      name = "palm3710";      break;
53         case ide_acorn:         name = "acorn";         break;
54         default:                name = "(unknown)";     break;
55         }
56         len = sprintf(page, "%s\n", name);
57         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
58 }
59
60 static int proc_ide_read_mate
61         (char *page, char **start, off_t off, int count, int *eof, void *data)
62 {
63         ide_hwif_t      *hwif = (ide_hwif_t *) data;
64         int             len;
65
66         if (hwif && hwif->mate)
67                 len = sprintf(page, "%s\n", hwif->mate->name);
68         else
69                 len = sprintf(page, "(none)\n");
70         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
71 }
72
73 static int proc_ide_read_channel
74         (char *page, char **start, off_t off, int count, int *eof, void *data)
75 {
76         ide_hwif_t      *hwif = (ide_hwif_t *) data;
77         int             len;
78
79         page[0] = hwif->channel ? '1' : '0';
80         page[1] = '\n';
81         len = 2;
82         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
83 }
84
85 static int proc_ide_read_identify
86         (char *page, char **start, off_t off, int count, int *eof, void *data)
87 {
88         ide_drive_t     *drive = (ide_drive_t *)data;
89         int             len = 0, i = 0;
90         int             err = 0;
91
92         len = sprintf(page, "\n");
93
94         if (drive) {
95                 __le16 *val = (__le16 *)page;
96
97                 err = taskfile_lib_get_identify(drive, page);
98                 if (!err) {
99                         char *out = (char *)page + SECTOR_SIZE;
100
101                         page = out;
102                         do {
103                                 out += sprintf(out, "%04x%c",
104                                         le16_to_cpup(val), (++i & 7) ? ' ' : '\n');
105                                 val += 1;
106                         } while (i < SECTOR_SIZE / 2);
107                         len = out - page;
108                 }
109         }
110         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
111 }
112
113 /**
114  *      ide_find_setting        -       find a specific setting
115  *      @st: setting table pointer
116  *      @name: setting name
117  *
118  *      Scan's the setting table for a matching entry and returns
119  *      this or NULL if no entry is found. The caller must hold the
120  *      setting semaphore
121  */
122
123 static
124 const struct ide_proc_devset *ide_find_setting(const struct ide_proc_devset *st,
125                                                char *name)
126 {
127         while (st->name) {
128                 if (strcmp(st->name, name) == 0)
129                         break;
130                 st++;
131         }
132         return st->name ? st : NULL;
133 }
134
135 /**
136  *      ide_read_setting        -       read an IDE setting
137  *      @drive: drive to read from
138  *      @setting: drive setting
139  *
140  *      Read a drive setting and return the value. The caller
141  *      must hold the ide_setting_mtx when making this call.
142  *
143  *      BUGS: the data return and error are the same return value
144  *      so an error -EINVAL and true return of the same value cannot
145  *      be told apart
146  */
147
148 static int ide_read_setting(ide_drive_t *drive,
149                             const struct ide_proc_devset *setting)
150 {
151         const struct ide_devset *ds = setting->setting;
152         int val = -EINVAL;
153
154         if (ds->get)
155                 val = ds->get(drive);
156
157         return val;
158 }
159
160 /**
161  *      ide_write_setting       -       read an IDE setting
162  *      @drive: drive to read from
163  *      @setting: drive setting
164  *      @val: value
165  *
166  *      Write a drive setting if it is possible. The caller
167  *      must hold the ide_setting_mtx when making this call.
168  *
169  *      BUGS: the data return and error are the same return value
170  *      so an error -EINVAL and true return of the same value cannot
171  *      be told apart
172  *
173  *      FIXME:  This should be changed to enqueue a special request
174  *      to the driver to change settings, and then wait on a sema for completion.
175  *      The current scheme of polling is kludgy, though safe enough.
176  */
177
178 static int ide_write_setting(ide_drive_t *drive,
179                              const struct ide_proc_devset *setting, int val)
180 {
181         const struct ide_devset *ds = setting->setting;
182
183         if (!capable(CAP_SYS_ADMIN))
184                 return -EACCES;
185         if (!ds->set)
186                 return -EPERM;
187         if ((ds->flags & DS_SYNC)
188             && (val < setting->min || val > setting->max))
189                 return -EINVAL;
190         return ide_devset_execute(drive, ds, val);
191 }
192
193 ide_devset_get(xfer_rate, current_speed);
194
195 static int set_xfer_rate (ide_drive_t *drive, int arg)
196 {
197         struct ide_cmd cmd;
198
199         if (arg < XFER_PIO_0 || arg > XFER_UDMA_6)
200                 return -EINVAL;
201
202         memset(&cmd, 0, sizeof(cmd));
203         cmd.tf.command = ATA_CMD_SET_FEATURES;
204         cmd.tf.feature = SETFEATURES_XFER;
205         cmd.tf.nsect   = (u8)arg;
206         cmd.valid.out.tf = IDE_VALID_FEATURE | IDE_VALID_NSECT;
207         cmd.valid.in.tf  = IDE_VALID_NSECT;
208         cmd.tf_flags   = IDE_TFLAG_SET_XFER;
209
210         return ide_no_data_taskfile(drive, &cmd);
211 }
212
213 ide_devset_rw(current_speed, xfer_rate);
214 ide_devset_rw_field(init_speed, init_speed);
215 ide_devset_rw_flag(nice1, IDE_DFLAG_NICE1);
216 ide_devset_rw_field(number, dn);
217
218 static const struct ide_proc_devset ide_generic_settings[] = {
219         IDE_PROC_DEVSET(current_speed, 0, 70),
220         IDE_PROC_DEVSET(init_speed, 0, 70),
221         IDE_PROC_DEVSET(io_32bit,  0, 1 + (SUPPORT_VLB_SYNC << 1)),
222         IDE_PROC_DEVSET(keepsettings, 0, 1),
223         IDE_PROC_DEVSET(nice1, 0, 1),
224         IDE_PROC_DEVSET(number, 0, 3),
225         IDE_PROC_DEVSET(pio_mode, 0, 255),
226         IDE_PROC_DEVSET(unmaskirq, 0, 1),
227         IDE_PROC_DEVSET(using_dma, 0, 1),
228         { NULL },
229 };
230
231 static void proc_ide_settings_warn(void)
232 {
233         static int warned;
234
235         if (warned)
236                 return;
237
238         printk(KERN_WARNING "Warning: /proc/ide/hd?/settings interface is "
239                             "obsolete, and will be removed soon!\n");
240         warned = 1;
241 }
242
243 static int proc_ide_read_settings
244         (char *page, char **start, off_t off, int count, int *eof, void *data)
245 {
246         const struct ide_proc_devset *setting, *g, *d;
247         const struct ide_devset *ds;
248         ide_drive_t     *drive = (ide_drive_t *) data;
249         char            *out = page;
250         int             len, rc, mul_factor, div_factor;
251
252         proc_ide_settings_warn();
253
254         mutex_lock(&ide_setting_mtx);
255         g = ide_generic_settings;
256         d = drive->settings;
257         out += sprintf(out, "name\t\t\tvalue\t\tmin\t\tmax\t\tmode\n");
258         out += sprintf(out, "----\t\t\t-----\t\t---\t\t---\t\t----\n");
259         while (g->name || (d && d->name)) {
260                 /* read settings in the alphabetical order */
261                 if (g->name && d && d->name) {
262                         if (strcmp(d->name, g->name) < 0)
263                                 setting = d++;
264                         else
265                                 setting = g++;
266                 } else if (d && d->name) {
267                         setting = d++;
268                 } else
269                         setting = g++;
270                 mul_factor = setting->mulf ? setting->mulf(drive) : 1;
271                 div_factor = setting->divf ? setting->divf(drive) : 1;
272                 out += sprintf(out, "%-24s", setting->name);
273                 rc = ide_read_setting(drive, setting);
274                 if (rc >= 0)
275                         out += sprintf(out, "%-16d", rc * mul_factor / div_factor);
276                 else
277                         out += sprintf(out, "%-16s", "write-only");
278                 out += sprintf(out, "%-16d%-16d", (setting->min * mul_factor + div_factor - 1) / div_factor, setting->max * mul_factor / div_factor);
279                 ds = setting->setting;
280                 if (ds->get)
281                         out += sprintf(out, "r");
282                 if (ds->set)
283                         out += sprintf(out, "w");
284                 out += sprintf(out, "\n");
285         }
286         len = out - page;
287         mutex_unlock(&ide_setting_mtx);
288         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
289 }
290
291 #define MAX_LEN 30
292
293 static int proc_ide_write_settings(struct file *file, const char __user *buffer,
294                                    unsigned long count, void *data)
295 {
296         ide_drive_t     *drive = (ide_drive_t *) data;
297         char            name[MAX_LEN + 1];
298         int             for_real = 0, mul_factor, div_factor;
299         unsigned long   n;
300
301         const struct ide_proc_devset *setting;
302         char *buf, *s;
303
304         if (!capable(CAP_SYS_ADMIN))
305                 return -EACCES;
306
307         proc_ide_settings_warn();
308
309         if (count >= PAGE_SIZE)
310                 return -EINVAL;
311
312         s = buf = (char *)__get_free_page(GFP_USER);
313         if (!buf)
314                 return -ENOMEM;
315
316         if (copy_from_user(buf, buffer, count)) {
317                 free_page((unsigned long)buf);
318                 return -EFAULT;
319         }
320
321         buf[count] = '\0';
322
323         /*
324          * Skip over leading whitespace
325          */
326         while (count && isspace(*s)) {
327                 --count;
328                 ++s;
329         }
330         /*
331          * Do one full pass to verify all parameters,
332          * then do another to actually write the new settings.
333          */
334         do {
335                 char *p = s;
336                 n = count;
337                 while (n > 0) {
338                         unsigned val;
339                         char *q = p;
340
341                         while (n > 0 && *p != ':') {
342                                 --n;
343                                 p++;
344                         }
345                         if (*p != ':')
346                                 goto parse_error;
347                         if (p - q > MAX_LEN)
348                                 goto parse_error;
349                         memcpy(name, q, p - q);
350                         name[p - q] = 0;
351
352                         if (n > 0) {
353                                 --n;
354                                 p++;
355                         } else
356                                 goto parse_error;
357
358                         val = simple_strtoul(p, &q, 10);
359                         n -= q - p;
360                         p = q;
361                         if (n > 0 && !isspace(*p))
362                                 goto parse_error;
363                         while (n > 0 && isspace(*p)) {
364                                 --n;
365                                 ++p;
366                         }
367
368                         mutex_lock(&ide_setting_mtx);
369                         /* generic settings first, then driver specific ones */
370                         setting = ide_find_setting(ide_generic_settings, name);
371                         if (!setting) {
372                                 if (drive->settings)
373                                         setting = ide_find_setting(drive->settings, name);
374                                 if (!setting) {
375                                         mutex_unlock(&ide_setting_mtx);
376                                         goto parse_error;
377                                 }
378                         }
379                         if (for_real) {
380                                 mul_factor = setting->mulf ? setting->mulf(drive) : 1;
381                                 div_factor = setting->divf ? setting->divf(drive) : 1;
382                                 ide_write_setting(drive, setting, val * div_factor / mul_factor);
383                         }
384                         mutex_unlock(&ide_setting_mtx);
385                 }
386         } while (!for_real++);
387         free_page((unsigned long)buf);
388         return count;
389 parse_error:
390         free_page((unsigned long)buf);
391         printk("proc_ide_write_settings(): parse error\n");
392         return -EINVAL;
393 }
394
395 int proc_ide_read_capacity
396         (char *page, char **start, off_t off, int count, int *eof, void *data)
397 {
398         int len = sprintf(page, "%llu\n", (long long)0x7fffffff);
399         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
400 }
401
402 EXPORT_SYMBOL_GPL(proc_ide_read_capacity);
403
404 int proc_ide_read_geometry
405         (char *page, char **start, off_t off, int count, int *eof, void *data)
406 {
407         ide_drive_t     *drive = (ide_drive_t *) data;
408         char            *out = page;
409         int             len;
410
411         out += sprintf(out, "physical     %d/%d/%d\n",
412                         drive->cyl, drive->head, drive->sect);
413         out += sprintf(out, "logical      %d/%d/%d\n",
414                         drive->bios_cyl, drive->bios_head, drive->bios_sect);
415
416         len = out - page;
417         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
418 }
419
420 EXPORT_SYMBOL(proc_ide_read_geometry);
421
422 static int proc_ide_read_dmodel
423         (char *page, char **start, off_t off, int count, int *eof, void *data)
424 {
425         ide_drive_t     *drive = (ide_drive_t *) data;
426         char            *m = (char *)&drive->id[ATA_ID_PROD];
427         int             len;
428
429         len = sprintf(page, "%.40s\n", m[0] ? m : "(none)");
430         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
431 }
432
433 static int proc_ide_read_driver
434         (char *page, char **start, off_t off, int count, int *eof, void *data)
435 {
436         ide_drive_t             *drive = (ide_drive_t *)data;
437         struct device           *dev = &drive->gendev;
438         struct ide_driver       *ide_drv;
439         int                     len;
440
441         if (dev->driver) {
442                 ide_drv = to_ide_driver(dev->driver);
443                 len = sprintf(page, "%s version %s\n",
444                                 dev->driver->name, ide_drv->version);
445         } else
446                 len = sprintf(page, "ide-default version 0.9.newide\n");
447         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
448 }
449
450 static int ide_replace_subdriver(ide_drive_t *drive, const char *driver)
451 {
452         struct device *dev = &drive->gendev;
453         int ret = 1;
454         int err;
455
456         device_release_driver(dev);
457         /* FIXME: device can still be in use by previous driver */
458         strlcpy(drive->driver_req, driver, sizeof(drive->driver_req));
459         err = device_attach(dev);
460         if (err < 0)
461                 printk(KERN_WARNING "IDE: %s: device_attach error: %d\n",
462                         __func__, err);
463         drive->driver_req[0] = 0;
464         if (dev->driver == NULL) {
465                 err = device_attach(dev);
466                 if (err < 0)
467                         printk(KERN_WARNING
468                                 "IDE: %s: device_attach(2) error: %d\n",
469                                 __func__, err);
470         }
471         if (dev->driver && !strcmp(dev->driver->name, driver))
472                 ret = 0;
473
474         return ret;
475 }
476
477 static int proc_ide_write_driver
478         (struct file *file, const char __user *buffer, unsigned long count, void *data)
479 {
480         ide_drive_t     *drive = (ide_drive_t *) data;
481         char name[32];
482
483         if (!capable(CAP_SYS_ADMIN))
484                 return -EACCES;
485         if (count > 31)
486                 count = 31;
487         if (copy_from_user(name, buffer, count))
488                 return -EFAULT;
489         name[count] = '\0';
490         if (ide_replace_subdriver(drive, name))
491                 return -EINVAL;
492         return count;
493 }
494
495 static int proc_ide_read_media
496         (char *page, char **start, off_t off, int count, int *eof, void *data)
497 {
498         ide_drive_t     *drive = (ide_drive_t *) data;
499         const char      *media;
500         int             len;
501
502         switch (drive->media) {
503         case ide_disk:          media = "disk\n";       break;
504         case ide_cdrom:         media = "cdrom\n";      break;
505         case ide_tape:          media = "tape\n";       break;
506         case ide_floppy:        media = "floppy\n";     break;
507         case ide_optical:       media = "optical\n";    break;
508         default:                media = "UNKNOWN\n";    break;
509         }
510         strcpy(page, media);
511         len = strlen(media);
512         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
513 }
514
515 static ide_proc_entry_t generic_drive_entries[] = {
516         { "driver",     S_IFREG|S_IRUGO,         proc_ide_read_driver,
517                                                  proc_ide_write_driver },
518         { "identify",   S_IFREG|S_IRUSR,         proc_ide_read_identify, NULL },
519         { "media",      S_IFREG|S_IRUGO,         proc_ide_read_media,    NULL },
520         { "model",      S_IFREG|S_IRUGO,         proc_ide_read_dmodel,   NULL },
521         { "settings",   S_IFREG|S_IRUSR|S_IWUSR, proc_ide_read_settings,
522                                                  proc_ide_write_settings },
523         { NULL, 0, NULL, NULL }
524 };
525
526 static void ide_add_proc_entries(struct proc_dir_entry *dir, ide_proc_entry_t *p, void *data)
527 {
528         struct proc_dir_entry *ent;
529
530         if (!dir || !p)
531                 return;
532         while (p->name != NULL) {
533                 ent = create_proc_entry(p->name, p->mode, dir);
534                 if (!ent) return;
535                 ent->data = data;
536                 ent->read_proc = p->read_proc;
537                 ent->write_proc = p->write_proc;
538                 p++;
539         }
540 }
541
542 static void ide_remove_proc_entries(struct proc_dir_entry *dir, ide_proc_entry_t *p)
543 {
544         if (!dir || !p)
545                 return;
546         while (p->name != NULL) {
547                 remove_proc_entry(p->name, dir);
548                 p++;
549         }
550 }
551
552 void ide_proc_register_driver(ide_drive_t *drive, struct ide_driver *driver)
553 {
554         mutex_lock(&ide_setting_mtx);
555         drive->settings = driver->proc_devsets(drive);
556         mutex_unlock(&ide_setting_mtx);
557
558         ide_add_proc_entries(drive->proc, driver->proc_entries(drive), drive);
559 }
560
561 EXPORT_SYMBOL(ide_proc_register_driver);
562
563 /**
564  *      ide_proc_unregister_driver      -       remove driver specific data
565  *      @drive: drive
566  *      @driver: driver
567  *
568  *      Clean up the driver specific /proc files and IDE settings
569  *      for a given drive.
570  *
571  *      Takes ide_setting_mtx.
572  */
573
574 void ide_proc_unregister_driver(ide_drive_t *drive, struct ide_driver *driver)
575 {
576         ide_remove_proc_entries(drive->proc, driver->proc_entries(drive));
577
578         mutex_lock(&ide_setting_mtx);
579         /*
580          * ide_setting_mtx protects both the settings list and the use
581          * of settings (we cannot take a setting out that is being used).
582          */
583         drive->settings = NULL;
584         mutex_unlock(&ide_setting_mtx);
585 }
586 EXPORT_SYMBOL(ide_proc_unregister_driver);
587
588 void ide_proc_port_register_devices(ide_hwif_t *hwif)
589 {
590         struct proc_dir_entry *ent;
591         struct proc_dir_entry *parent = hwif->proc;
592         ide_drive_t *drive;
593         char name[64];
594         int i;
595
596         ide_port_for_each_dev(i, drive, hwif) {
597                 if ((drive->dev_flags & IDE_DFLAG_PRESENT) == 0)
598                         continue;
599
600                 drive->proc = proc_mkdir(drive->name, parent);
601                 if (drive->proc)
602                         ide_add_proc_entries(drive->proc, generic_drive_entries, drive);
603                 sprintf(name, "ide%d/%s", (drive->name[2]-'a')/2, drive->name);
604                 ent = proc_symlink(drive->name, proc_ide_root, name);
605                 if (!ent) return;
606         }
607 }
608
609 void ide_proc_unregister_device(ide_drive_t *drive)
610 {
611         if (drive->proc) {
612                 ide_remove_proc_entries(drive->proc, generic_drive_entries);
613                 remove_proc_entry(drive->name, proc_ide_root);
614                 remove_proc_entry(drive->name, drive->hwif->proc);
615                 drive->proc = NULL;
616         }
617 }
618
619 static ide_proc_entry_t hwif_entries[] = {
620         { "channel",    S_IFREG|S_IRUGO,        proc_ide_read_channel,  NULL },
621         { "mate",       S_IFREG|S_IRUGO,        proc_ide_read_mate,     NULL },
622         { "model",      S_IFREG|S_IRUGO,        proc_ide_read_imodel,   NULL },
623         { NULL, 0, NULL, NULL }
624 };
625
626 void ide_proc_register_port(ide_hwif_t *hwif)
627 {
628         if (!hwif->proc) {
629                 hwif->proc = proc_mkdir(hwif->name, proc_ide_root);
630
631                 if (!hwif->proc)
632                         return;
633
634                 ide_add_proc_entries(hwif->proc, hwif_entries, hwif);
635         }
636 }
637
638 void ide_proc_unregister_port(ide_hwif_t *hwif)
639 {
640         if (hwif->proc) {
641                 ide_remove_proc_entries(hwif->proc, hwif_entries);
642                 remove_proc_entry(hwif->name, proc_ide_root);
643                 hwif->proc = NULL;
644         }
645 }
646
647 static int proc_print_driver(struct device_driver *drv, void *data)
648 {
649         struct ide_driver *ide_drv = to_ide_driver(drv);
650         struct seq_file *s = data;
651
652         seq_printf(s, "%s version %s\n", drv->name, ide_drv->version);
653
654         return 0;
655 }
656
657 static int ide_drivers_show(struct seq_file *s, void *p)
658 {
659         int err;
660
661         err = bus_for_each_drv(&ide_bus_type, NULL, s, proc_print_driver);
662         if (err < 0)
663                 printk(KERN_WARNING "IDE: %s: bus_for_each_drv error: %d\n",
664                         __func__, err);
665         return 0;
666 }
667
668 static int ide_drivers_open(struct inode *inode, struct file *file)
669 {
670         return single_open(file, &ide_drivers_show, NULL);
671 }
672
673 static const struct file_operations ide_drivers_operations = {
674         .owner          = THIS_MODULE,
675         .open           = ide_drivers_open,
676         .read           = seq_read,
677         .llseek         = seq_lseek,
678         .release        = single_release,
679 };
680
681 void proc_ide_create(void)
682 {
683         proc_ide_root = proc_mkdir("ide", NULL);
684
685         if (!proc_ide_root)
686                 return;
687
688         proc_create("drivers", 0, proc_ide_root, &ide_drivers_operations);
689 }
690
691 void proc_ide_destroy(void)
692 {
693         remove_proc_entry("drivers", proc_ide_root);
694         remove_proc_entry("ide", NULL);
695 }