target/linux/generic/backport-5.15/423-v6.1-0004-mtdchar-add-MEMREAD-ioctl.patch

   1 From 2c9745d36e04ac27161acd78514f647b9b587ad4 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <kernel@kempniu.pl>
   3 Date: Wed, 29 Jun 2022 14:57:37 +0200
   4 Subject: [PATCH 4/4] mtdchar: add MEMREAD ioctl
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 User-space applications making use of MTD devices via /dev/mtd*
  10 character devices currently have limited capabilities for reading data:
  11
  12   - only deprecated methods of accessing OOB layout information exist,
  13
  14   - there is no way to explicitly specify MTD operation mode to use; it
  15     is auto-selected based on the MTD file mode (MTD_FILE_MODE_*) set
  16     for the character device; in particular, this prevents using
  17     MTD_OPS_AUTO_OOB for reads,
  18
  19   - all existing user-space interfaces which cause mtd_read() or
  20     mtd_read_oob() to be called (via mtdchar_read() and
  21     mtdchar_read_oob(), respectively) return success even when those
  22     functions return -EUCLEAN or -EBADMSG; this renders user-space
  23     applications using these interfaces unaware of any corrected
  24     bitflips or uncorrectable ECC errors detected during reads.
  25
  26 Note that the existing MEMWRITE ioctl allows the MTD operation mode to
  27 be explicitly set, allowing user-space applications to write page data
  28 and OOB data without requiring them to know anything about the OOB
  29 layout of the MTD device they are writing to (MTD_OPS_AUTO_OOB).  Also,
  30 the MEMWRITE ioctl does not mangle the return value of mtd_write_oob().
  31
  32 Add a new ioctl, MEMREAD, which addresses the above issues.  It is
  33 intended to be a read-side counterpart of the existing MEMWRITE ioctl.
  34 Similarly to the latter, the read operation is performed in a loop which
  35 processes at most mtd->erasesize bytes in each iteration.  This is done
  36 to prevent unbounded memory allocations caused by calling kmalloc() with
  37 the 'size' argument taken directly from the struct mtd_read_req provided
  38 by user space.  However, the new ioctl is implemented so that the values
  39 it returns match those that would have been returned if just a single
  40 mtd_read_oob() call was issued to handle the entire read operation in
  41 one go.
  42
  43 Note that while just returning -EUCLEAN or -EBADMSG to user space would
  44 already be a valid and useful indication of the ECC algorithm detecting
  45 errors during a read operation, that signal would not be granular enough
  46 to cover all use cases.  For example, knowing the maximum number of
  47 bitflips detected in a single ECC step during a read operation performed
  48 on a given page may be useful when dealing with an MTD partition whose
  49 ECC layout varies across pages (e.g. a partition consisting of a
  50 bootloader area using a "custom" ECC layout followed by data pages using
  51 a "standard" ECC layout).  To address that, include ECC statistics in
  52 the structure returned to user space by the new MEMREAD ioctl.
  53
  54 Link: https://www.infradead.org/pipermail/linux-mtd/2016-April/067085.html
  55
  56 Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
  57 Signed-off-by: Michał Kępień <kernel@kempniu.pl>
  58 Acked-by: Richard Weinberger <richard@nod.at>
  59 Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
  60 Link: https://lore.kernel.org/linux-mtd/20220629125737.14418-5-kernel@kempniu.pl
  61 ---
  62  drivers/mtd/mtdchar.c      | 139 +++++++++++++++++++++++++++++++++++++
  63  include/uapi/mtd/mtd-abi.h |  64 +++++++++++++++--
  64  2 files changed, 198 insertions(+), 5 deletions(-)
  65
  66 --- a/drivers/mtd/mtdchar.c
  67 +++ b/drivers/mtd/mtdchar.c
  68 @@ -621,6 +621,137 @@ static int mtdchar_write_ioctl(struct mt
  69         return ret;
  70  }
  71
  72 +static int mtdchar_read_ioctl(struct mtd_info *mtd,
  73 +               struct mtd_read_req __user *argp)
  74 +{
  75 +       struct mtd_info *master = mtd_get_master(mtd);
  76 +       struct mtd_read_req req;
  77 +       void __user *usr_data, *usr_oob;
  78 +       uint8_t *datbuf = NULL, *oobbuf = NULL;
  79 +       size_t datbuf_len, oobbuf_len;
  80 +       size_t orig_len, orig_ooblen;
  81 +       int ret = 0;
  82 +
  83 +       if (copy_from_user(&req, argp, sizeof(req)))
  84 +               return -EFAULT;
  85 +
  86 +       orig_len = req.len;
  87 +       orig_ooblen = req.ooblen;
  88 +
  89 +       usr_data = (void __user *)(uintptr_t)req.usr_data;
  90 +       usr_oob = (void __user *)(uintptr_t)req.usr_oob;
  91 +
  92 +       if (!master->_read_oob)
  93 +               return -EOPNOTSUPP;
  94 +
  95 +       if (!usr_data)
  96 +               req.len = 0;
  97 +
  98 +       if (!usr_oob)
  99 +               req.ooblen = 0;
 100 +
 101 +       req.ecc_stats.uncorrectable_errors = 0;
 102 +       req.ecc_stats.corrected_bitflips = 0;
 103 +       req.ecc_stats.max_bitflips = 0;
 104 +
 105 +       req.len &= 0xffffffff;
 106 +       req.ooblen &= 0xffffffff;
 107 +
 108 +       if (req.start + req.len > mtd->size) {
 109 +               ret = -EINVAL;
 110 +               goto out;
 111 +       }
 112 +
 113 +       datbuf_len = min_t(size_t, req.len, mtd->erasesize);
 114 +       if (datbuf_len > 0) {
 115 +               datbuf = kvmalloc(datbuf_len, GFP_KERNEL);
 116 +               if (!datbuf) {
 117 +                       ret = -ENOMEM;
 118 +                       goto out;
 119 +               }
 120 +       }
 121 +
 122 +       oobbuf_len = min_t(size_t, req.ooblen, mtd->erasesize);
 123 +       if (oobbuf_len > 0) {
 124 +               oobbuf = kvmalloc(oobbuf_len, GFP_KERNEL);
 125 +               if (!oobbuf) {
 126 +                       ret = -ENOMEM;
 127 +                       goto out;
 128 +               }
 129 +       }
 130 +
 131 +       while (req.len > 0 || (!usr_data && req.ooblen > 0)) {
 132 +               struct mtd_req_stats stats;
 133 +               struct mtd_oob_ops ops = {
 134 +                       .mode = req.mode,
 135 +                       .len = min_t(size_t, req.len, datbuf_len),
 136 +                       .ooblen = min_t(size_t, req.ooblen, oobbuf_len),
 137 +                       .datbuf = datbuf,
 138 +                       .oobbuf = oobbuf,
 139 +                       .stats = &stats,
 140 +               };
 141 +
 142 +               /*
 143 +                * Shorten non-page-aligned, eraseblock-sized reads so that the
 144 +                * read ends on an eraseblock boundary.  This is necessary in
 145 +                * order to prevent OOB data for some pages from being
 146 +                * duplicated in the output of non-page-aligned reads requiring
 147 +                * multiple mtd_read_oob() calls to be completed.
 148 +                */
 149 +               if (ops.len == mtd->erasesize)
 150 +                       ops.len -= mtd_mod_by_ws(req.start + ops.len, mtd);
 151 +
 152 +               ret = mtd_read_oob(mtd, (loff_t)req.start, &ops);
 153 +
 154 +               req.ecc_stats.uncorrectable_errors +=
 155 +                       stats.uncorrectable_errors;
 156 +               req.ecc_stats.corrected_bitflips += stats.corrected_bitflips;
 157 +               req.ecc_stats.max_bitflips =
 158 +                       max(req.ecc_stats.max_bitflips, stats.max_bitflips);
 159 +
 160 +               if (ret && !mtd_is_bitflip_or_eccerr(ret))
 161 +                       break;
 162 +
 163 +               if (copy_to_user(usr_data, ops.datbuf, ops.retlen) ||
 164 +                   copy_to_user(usr_oob, ops.oobbuf, ops.oobretlen)) {
 165 +                       ret = -EFAULT;
 166 +                       break;
 167 +               }
 168 +
 169 +               req.start += ops.retlen;
 170 +               req.len -= ops.retlen;
 171 +               usr_data += ops.retlen;
 172 +
 173 +               req.ooblen -= ops.oobretlen;
 174 +               usr_oob += ops.oobretlen;
 175 +       }
 176 +
 177 +       /*
 178 +        * As multiple iterations of the above loop (and therefore multiple
 179 +        * mtd_read_oob() calls) may be necessary to complete the read request,
 180 +        * adjust the final return code to ensure it accounts for all detected
 181 +        * ECC errors.
 182 +        */
 183 +       if (!ret || mtd_is_bitflip(ret)) {
 184 +               if (req.ecc_stats.uncorrectable_errors > 0)
 185 +                       ret = -EBADMSG;
 186 +               else if (req.ecc_stats.corrected_bitflips > 0)
 187 +                       ret = -EUCLEAN;
 188 +       }
 189 +
 190 +out:
 191 +       req.len = orig_len - req.len;
 192 +       req.ooblen = orig_ooblen - req.ooblen;
 193 +
 194 +       if (copy_to_user(argp, &req, sizeof(req)))
 195 +               ret = -EFAULT;
 196 +
 197 +       kvfree(datbuf);
 198 +       kvfree(oobbuf);
 199 +
 200 +       return ret;
 201 +}
 202 +
 203  static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 204  {
 205         struct mtd_file_info *mfi = file->private_data;
 206 @@ -643,6 +774,7 @@ static int mtdchar_ioctl(struct file *fi
 207         case MEMGETINFO:
 208         case MEMREADOOB:
 209         case MEMREADOOB64:
 210 +       case MEMREAD:
 211         case MEMISLOCKED:
 212         case MEMGETOOBSEL:
 213         case MEMGETBADBLOCK:
 214 @@ -817,6 +949,13 @@ static int mtdchar_ioctl(struct file *fi
 215                 break;
 216         }
 217
 218 +       case MEMREAD:
 219 +       {
 220 +               ret = mtdchar_read_ioctl(mtd,
 221 +                     (struct mtd_read_req __user *)arg);
 222 +               break;
 223 +       }
 224 +
 225         case MEMLOCK:
 226         {
 227                 struct erase_info_user einfo;
 228 --- a/include/uapi/mtd/mtd-abi.h
 229 +++ b/include/uapi/mtd/mtd-abi.h
 230 @@ -55,9 +55,9 @@ struct mtd_oob_buf64 {
 231   * @MTD_OPS_RAW:       data are transferred as-is, with no error correction;
 232   *                     this mode implies %MTD_OPS_PLACE_OOB
 233   *
 234 - * These modes can be passed to ioctl(MEMWRITE) and are also used internally.
 235 - * See notes on "MTD file modes" for discussion on %MTD_OPS_RAW vs.
 236 - * %MTD_FILE_MODE_RAW.
 237 + * These modes can be passed to ioctl(MEMWRITE) and ioctl(MEMREAD); they are
 238 + * also used internally. See notes on "MTD file modes" for discussion on
 239 + * %MTD_OPS_RAW vs. %MTD_FILE_MODE_RAW.
 240   */
 241  enum {
 242         MTD_OPS_PLACE_OOB = 0,
 243 @@ -91,6 +91,53 @@ struct mtd_write_req {
 244         __u8 padding[7];
 245  };
 246
 247 +/**
 248 + * struct mtd_read_req_ecc_stats - ECC statistics for a read operation
 249 + *
 250 + * @uncorrectable_errors: the number of uncorrectable errors that happened
 251 + *                       during the read operation
 252 + * @corrected_bitflips: the number of bitflips corrected during the read
 253 + *                     operation
 254 + * @max_bitflips: the maximum number of bitflips detected in any single ECC
 255 + *               step for the data read during the operation; this information
 256 + *               can be used to decide whether the data stored in a specific
 257 + *               region of the MTD device should be moved somewhere else to
 258 + *               avoid data loss.
 259 + */
 260 +struct mtd_read_req_ecc_stats {
 261 +       __u32 uncorrectable_errors;
 262 +       __u32 corrected_bitflips;
 263 +       __u32 max_bitflips;
 264 +};
 265 +
 266 +/**
 267 + * struct mtd_read_req - data structure for requesting a read operation
 268 + *
 269 + * @start:     start address
 270 + * @len:       length of data buffer (only lower 32 bits are used)
 271 + * @ooblen:    length of OOB buffer (only lower 32 bits are used)
 272 + * @usr_data:  user-provided data buffer
 273 + * @usr_oob:   user-provided OOB buffer
 274 + * @mode:      MTD mode (see "MTD operation modes")
 275 + * @padding:   reserved, must be set to 0
 276 + * @ecc_stats: ECC statistics for the read operation
 277 + *
 278 + * This structure supports ioctl(MEMREAD) operations, allowing data and/or OOB
 279 + * reads in various modes. To read from OOB-only, set @usr_data == NULL, and to
 280 + * read data-only, set @usr_oob == NULL. However, setting both @usr_data and
 281 + * @usr_oob to NULL is not allowed.
 282 + */
 283 +struct mtd_read_req {
 284 +       __u64 start;
 285 +       __u64 len;
 286 +       __u64 ooblen;
 287 +       __u64 usr_data;
 288 +       __u64 usr_oob;
 289 +       __u8 mode;
 290 +       __u8 padding[7];
 291 +       struct mtd_read_req_ecc_stats ecc_stats;
 292 +};
 293 +
 294  #define MTD_ABSENT             0
 295  #define MTD_RAM                        1
 296  #define MTD_ROM                        2
 297 @@ -207,6 +254,12 @@ struct otp_info {
 298  #define MEMWRITE               _IOWR('M', 24, struct mtd_write_req)
 299  /* Erase a given range of user data (must be in mode %MTD_FILE_MODE_OTP_USER) */
 300  #define OTPERASE               _IOW('M', 25, struct otp_info)
 301 +/*
 302 + * Most generic read interface; can read in-band and/or out-of-band in various
 303 + * modes (see "struct mtd_read_req"). This ioctl is not supported for flashes
 304 + * without OOB, e.g., NOR flash.
 305 + */
 306 +#define MEMREAD                        _IOWR('M', 26, struct mtd_read_req)
 307
 308  /*
 309   * Obsolete legacy interface. Keep it in order not to break userspace
 310 @@ -270,8 +323,9 @@ struct mtd_ecc_stats {
 311   * Note: %MTD_FILE_MODE_RAW provides the same functionality as %MTD_OPS_RAW -
 312   * raw access to the flash, without error correction or autoplacement schemes.
 313   * Wherever possible, the MTD_OPS_* mode will override the MTD_FILE_MODE_* mode
 314 - * (e.g., when using ioctl(MEMWRITE)), but in some cases, the MTD_FILE_MODE is
 315 - * used out of necessity (e.g., `write()', ioctl(MEMWRITEOOB64)).
 316 + * (e.g., when using ioctl(MEMWRITE) or ioctl(MEMREAD)), but in some cases, the
 317 + * MTD_FILE_MODE is used out of necessity (e.g., `write()',
 318 + * ioctl(MEMWRITEOOB64)).
 319   */
 320  enum mtd_file_modes {
 321         MTD_FILE_MODE_NORMAL = MTD_OTP_OFF,