mtd: fix: avoid race condition when accessing mtd->usecount
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / mtd / mtd_blkdevs.c
1 /*
2 * Interface to Linux block layer for MTD 'translation layers'.
3 *
4 * Copyright © 2003-2010 David Woodhouse <dwmw2@infradead.org>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19 *
20 */
21
22 #include <linux/kernel.h>
23 #include <linux/slab.h>
24 #include <linux/module.h>
25 #include <linux/list.h>
26 #include <linux/fs.h>
27 #include <linux/mtd/blktrans.h>
28 #include <linux/mtd/mtd.h>
29 #include <linux/blkdev.h>
30 #include <linux/blkpg.h>
31 #include <linux/spinlock.h>
32 #include <linux/hdreg.h>
33 #include <linux/init.h>
34 #include <linux/mutex.h>
35 #include <asm/uaccess.h>
36
37 #include "mtdcore.h"
38
39 static LIST_HEAD(blktrans_majors);
40 static DEFINE_MUTEX(blktrans_ref_mutex);
41
42 static void blktrans_dev_release(struct kref *kref)
43 {
44 struct mtd_blktrans_dev *dev =
45 container_of(kref, struct mtd_blktrans_dev, ref);
46
47 dev->disk->private_data = NULL;
48 blk_cleanup_queue(dev->rq);
49 put_disk(dev->disk);
50 list_del(&dev->list);
51 kfree(dev);
52 }
53
54 static struct mtd_blktrans_dev *blktrans_dev_get(struct gendisk *disk)
55 {
56 struct mtd_blktrans_dev *dev;
57
58 mutex_lock(&blktrans_ref_mutex);
59 dev = disk->private_data;
60
61 if (!dev)
62 goto unlock;
63 kref_get(&dev->ref);
64 unlock:
65 mutex_unlock(&blktrans_ref_mutex);
66 return dev;
67 }
68
69 static void blktrans_dev_put(struct mtd_blktrans_dev *dev)
70 {
71 mutex_lock(&blktrans_ref_mutex);
72 kref_put(&dev->ref, blktrans_dev_release);
73 mutex_unlock(&blktrans_ref_mutex);
74 }
75
76
77 static int do_blktrans_request(struct mtd_blktrans_ops *tr,
78 struct mtd_blktrans_dev *dev,
79 struct request *req)
80 {
81 unsigned long block, nsect;
82 char *buf;
83
84 block = blk_rq_pos(req) << 9 >> tr->blkshift;
85 nsect = blk_rq_cur_bytes(req) >> tr->blkshift;
86
87 buf = req->buffer;
88
89 if (req->cmd_type != REQ_TYPE_FS)
90 return -EIO;
91
92 if (blk_rq_pos(req) + blk_rq_cur_sectors(req) >
93 get_capacity(req->rq_disk))
94 return -EIO;
95
96 if (req->cmd_flags & REQ_DISCARD)
97 return tr->discard(dev, block, nsect);
98
99 switch(rq_data_dir(req)) {
100 case READ:
101 for (; nsect > 0; nsect--, block++, buf += tr->blksize)
102 if (tr->readsect(dev, block, buf))
103 return -EIO;
104 rq_flush_dcache_pages(req);
105 return 0;
106 case WRITE:
107 if (!tr->writesect)
108 return -EIO;
109
110 rq_flush_dcache_pages(req);
111 for (; nsect > 0; nsect--, block++, buf += tr->blksize)
112 if (tr->writesect(dev, block, buf))
113 return -EIO;
114 return 0;
115 default:
116 printk(KERN_NOTICE "Unknown request %u\n", rq_data_dir(req));
117 return -EIO;
118 }
119 }
120
121 int mtd_blktrans_cease_background(struct mtd_blktrans_dev *dev)
122 {
123 return dev->bg_stop;
124 }
125 EXPORT_SYMBOL_GPL(mtd_blktrans_cease_background);
126
127 static void mtd_blktrans_work(struct work_struct *work)
128 {
129 struct mtd_blktrans_dev *dev =
130 container_of(work, struct mtd_blktrans_dev, work);
131 struct mtd_blktrans_ops *tr = dev->tr;
132 struct request_queue *rq = dev->rq;
133 struct request *req = NULL;
134 int background_done = 0;
135
136 spin_lock_irq(rq->queue_lock);
137
138 while (1) {
139 int res;
140
141 dev->bg_stop = false;
142 if (!req && !(req = blk_fetch_request(rq))) {
143 if (tr->background && !background_done) {
144 spin_unlock_irq(rq->queue_lock);
145 mutex_lock(&dev->lock);
146 tr->background(dev);
147 mutex_unlock(&dev->lock);
148 spin_lock_irq(rq->queue_lock);
149 /*
150 * Do background processing just once per idle
151 * period.
152 */
153 background_done = !dev->bg_stop;
154 continue;
155 }
156 break;
157 }
158
159 spin_unlock_irq(rq->queue_lock);
160
161 mutex_lock(&dev->lock);
162 res = do_blktrans_request(dev->tr, dev, req);
163 mutex_unlock(&dev->lock);
164
165 spin_lock_irq(rq->queue_lock);
166
167 if (!__blk_end_request_cur(req, res))
168 req = NULL;
169
170 background_done = 0;
171 }
172
173 if (req)
174 __blk_end_request_all(req, -EIO);
175
176 spin_unlock_irq(rq->queue_lock);
177 }
178
179 static void mtd_blktrans_request(struct request_queue *rq)
180 {
181 struct mtd_blktrans_dev *dev;
182 struct request *req = NULL;
183
184 dev = rq->queuedata;
185
186 if (!dev)
187 while ((req = blk_fetch_request(rq)) != NULL)
188 __blk_end_request_all(req, -ENODEV);
189 else
190 queue_work(dev->wq, &dev->work);
191 }
192
193 static int blktrans_open(struct block_device *bdev, fmode_t mode)
194 {
195 struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk);
196 int ret = 0;
197
198 if (!dev)
199 return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
200
201 mutex_lock(&dev->lock);
202 mutex_lock(&mtd_table_mutex);
203
204 if (dev->open)
205 goto unlock;
206
207 kref_get(&dev->ref);
208 __module_get(dev->tr->owner);
209
210 if (!dev->mtd)
211 goto unlock;
212
213 if (dev->tr->open) {
214 ret = dev->tr->open(dev);
215 if (ret)
216 goto error_put;
217 }
218
219 ret = __get_mtd_device(dev->mtd);
220 if (ret)
221 goto error_release;
222 dev->file_mode = mode;
223
224 unlock:
225 dev->open++;
226 mutex_unlock(&mtd_table_mutex);
227 mutex_unlock(&dev->lock);
228 blktrans_dev_put(dev);
229 return ret;
230
231 error_release:
232 if (dev->tr->release)
233 dev->tr->release(dev);
234 error_put:
235 module_put(dev->tr->owner);
236 kref_put(&dev->ref, blktrans_dev_release);
237 mutex_unlock(&mtd_table_mutex);
238 mutex_unlock(&dev->lock);
239 blktrans_dev_put(dev);
240 return ret;
241 }
242
243 static void blktrans_release(struct gendisk *disk, fmode_t mode)
244 {
245 struct mtd_blktrans_dev *dev = blktrans_dev_get(disk);
246
247 if (!dev)
248 return;
249
250 mutex_lock(&dev->lock);
251 mutex_lock(&mtd_table_mutex);
252
253 if (--dev->open)
254 goto unlock;
255
256 kref_put(&dev->ref, blktrans_dev_release);
257 module_put(dev->tr->owner);
258
259 if (dev->mtd) {
260 if (dev->tr->release)
261 dev->tr->release(dev);
262 __put_mtd_device(dev->mtd);
263 }
264 unlock:
265 mutex_unlock(&mtd_table_mutex);
266 mutex_unlock(&dev->lock);
267 blktrans_dev_put(dev);
268 }
269
270 static int blktrans_getgeo(struct block_device *bdev, struct hd_geometry *geo)
271 {
272 struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk);
273 int ret = -ENXIO;
274
275 if (!dev)
276 return ret;
277
278 mutex_lock(&dev->lock);
279
280 if (!dev->mtd)
281 goto unlock;
282
283 ret = dev->tr->getgeo ? dev->tr->getgeo(dev, geo) : 0;
284 unlock:
285 mutex_unlock(&dev->lock);
286 blktrans_dev_put(dev);
287 return ret;
288 }
289
290 static int blktrans_ioctl(struct block_device *bdev, fmode_t mode,
291 unsigned int cmd, unsigned long arg)
292 {
293 struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk);
294 int ret = -ENXIO;
295
296 if (!dev)
297 return ret;
298
299 mutex_lock(&dev->lock);
300
301 if (!dev->mtd)
302 goto unlock;
303
304 switch (cmd) {
305 case BLKFLSBUF:
306 ret = dev->tr->flush ? dev->tr->flush(dev) : 0;
307 break;
308 default:
309 ret = -ENOTTY;
310 }
311 unlock:
312 mutex_unlock(&dev->lock);
313 blktrans_dev_put(dev);
314 return ret;
315 }
316
317 static const struct block_device_operations mtd_block_ops = {
318 .owner = THIS_MODULE,
319 .open = blktrans_open,
320 .release = blktrans_release,
321 .ioctl = blktrans_ioctl,
322 .getgeo = blktrans_getgeo,
323 };
324
325 int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
326 {
327 struct mtd_blktrans_ops *tr = new->tr;
328 struct mtd_blktrans_dev *d;
329 int last_devnum = -1;
330 struct gendisk *gd;
331 int ret;
332
333 if (mutex_trylock(&mtd_table_mutex)) {
334 mutex_unlock(&mtd_table_mutex);
335 BUG();
336 }
337
338 mutex_lock(&blktrans_ref_mutex);
339 list_for_each_entry(d, &tr->devs, list) {
340 if (new->devnum == -1) {
341 /* Use first free number */
342 if (d->devnum != last_devnum+1) {
343 /* Found a free devnum. Plug it in here */
344 new->devnum = last_devnum+1;
345 list_add_tail(&new->list, &d->list);
346 goto added;
347 }
348 } else if (d->devnum == new->devnum) {
349 /* Required number taken */
350 mutex_unlock(&blktrans_ref_mutex);
351 return -EBUSY;
352 } else if (d->devnum > new->devnum) {
353 /* Required number was free */
354 list_add_tail(&new->list, &d->list);
355 goto added;
356 }
357 last_devnum = d->devnum;
358 }
359
360 ret = -EBUSY;
361 if (new->devnum == -1)
362 new->devnum = last_devnum+1;
363
364 /* Check that the device and any partitions will get valid
365 * minor numbers and that the disk naming code below can cope
366 * with this number. */
367 if (new->devnum > (MINORMASK >> tr->part_bits) ||
368 (tr->part_bits && new->devnum >= 27 * 26)) {
369 mutex_unlock(&blktrans_ref_mutex);
370 goto error1;
371 }
372
373 list_add_tail(&new->list, &tr->devs);
374 added:
375 mutex_unlock(&blktrans_ref_mutex);
376
377 mutex_init(&new->lock);
378 kref_init(&new->ref);
379 if (!tr->writesect)
380 new->readonly = 1;
381
382 /* Create gendisk */
383 ret = -ENOMEM;
384 gd = alloc_disk(1 << tr->part_bits);
385
386 if (!gd)
387 goto error2;
388
389 new->disk = gd;
390 gd->private_data = new;
391 gd->major = tr->major;
392 gd->first_minor = (new->devnum) << tr->part_bits;
393 gd->fops = &mtd_block_ops;
394
395 if (tr->part_bits)
396 if (new->devnum < 26)
397 snprintf(gd->disk_name, sizeof(gd->disk_name),
398 "%s%c", tr->name, 'a' + new->devnum);
399 else
400 snprintf(gd->disk_name, sizeof(gd->disk_name),
401 "%s%c%c", tr->name,
402 'a' - 1 + new->devnum / 26,
403 'a' + new->devnum % 26);
404 else
405 snprintf(gd->disk_name, sizeof(gd->disk_name),
406 "%s%d", tr->name, new->devnum);
407
408 set_capacity(gd, (new->size * tr->blksize) >> 9);
409
410 /* Create the request queue */
411 spin_lock_init(&new->queue_lock);
412 new->rq = blk_init_queue(mtd_blktrans_request, &new->queue_lock);
413
414 if (!new->rq)
415 goto error3;
416
417 new->rq->queuedata = new;
418 blk_queue_logical_block_size(new->rq, tr->blksize);
419
420 queue_flag_set_unlocked(QUEUE_FLAG_NONROT, new->rq);
421
422 if (tr->discard) {
423 queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, new->rq);
424 new->rq->limits.max_discard_sectors = UINT_MAX;
425 }
426
427 gd->queue = new->rq;
428
429 /* Create processing workqueue */
430 new->wq = alloc_workqueue("%s%d", 0, 0,
431 tr->name, new->mtd->index);
432 if (!new->wq)
433 goto error4;
434 INIT_WORK(&new->work, mtd_blktrans_work);
435
436 gd->driverfs_dev = &new->mtd->dev;
437
438 if (new->readonly)
439 set_disk_ro(gd, 1);
440
441 add_disk(gd);
442
443 if (new->disk_attributes) {
444 ret = sysfs_create_group(&disk_to_dev(gd)->kobj,
445 new->disk_attributes);
446 WARN_ON(ret);
447 }
448 return 0;
449 error4:
450 blk_cleanup_queue(new->rq);
451 error3:
452 put_disk(new->disk);
453 error2:
454 list_del(&new->list);
455 error1:
456 return ret;
457 }
458
459 int del_mtd_blktrans_dev(struct mtd_blktrans_dev *old)
460 {
461 unsigned long flags;
462
463 if (mutex_trylock(&mtd_table_mutex)) {
464 mutex_unlock(&mtd_table_mutex);
465 BUG();
466 }
467
468 if (old->disk_attributes)
469 sysfs_remove_group(&disk_to_dev(old->disk)->kobj,
470 old->disk_attributes);
471
472 /* Stop new requests to arrive */
473 del_gendisk(old->disk);
474
475 /* Stop workqueue. This will perform any pending request. */
476 destroy_workqueue(old->wq);
477
478 /* Kill current requests */
479 spin_lock_irqsave(&old->queue_lock, flags);
480 old->rq->queuedata = NULL;
481 blk_start_queue(old->rq);
482 spin_unlock_irqrestore(&old->queue_lock, flags);
483
484 /* If the device is currently open, tell trans driver to close it,
485 then put mtd device, and don't touch it again */
486 mutex_lock(&old->lock);
487 if (old->open) {
488 if (old->tr->release)
489 old->tr->release(old);
490 __put_mtd_device(old->mtd);
491 }
492
493 old->mtd = NULL;
494
495 mutex_unlock(&old->lock);
496 blktrans_dev_put(old);
497 return 0;
498 }
499
500 static void blktrans_notify_remove(struct mtd_info *mtd)
501 {
502 struct mtd_blktrans_ops *tr;
503 struct mtd_blktrans_dev *dev, *next;
504
505 list_for_each_entry(tr, &blktrans_majors, list)
506 list_for_each_entry_safe(dev, next, &tr->devs, list)
507 if (dev->mtd == mtd)
508 tr->remove_dev(dev);
509 }
510
511 static void blktrans_notify_add(struct mtd_info *mtd)
512 {
513 struct mtd_blktrans_ops *tr;
514
515 if (mtd->type == MTD_ABSENT)
516 return;
517
518 list_for_each_entry(tr, &blktrans_majors, list)
519 tr->add_mtd(tr, mtd);
520 }
521
522 static struct mtd_notifier blktrans_notifier = {
523 .add = blktrans_notify_add,
524 .remove = blktrans_notify_remove,
525 };
526
527 int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
528 {
529 struct mtd_info *mtd;
530 int ret;
531
532 /* Register the notifier if/when the first device type is
533 registered, to prevent the link/init ordering from fucking
534 us over. */
535 if (!blktrans_notifier.list.next)
536 register_mtd_user(&blktrans_notifier);
537
538
539 mutex_lock(&mtd_table_mutex);
540
541 ret = register_blkdev(tr->major, tr->name);
542 if (ret < 0) {
543 printk(KERN_WARNING "Unable to register %s block device on major %d: %d\n",
544 tr->name, tr->major, ret);
545 mutex_unlock(&mtd_table_mutex);
546 return ret;
547 }
548
549 if (ret)
550 tr->major = ret;
551
552 tr->blkshift = ffs(tr->blksize) - 1;
553
554 INIT_LIST_HEAD(&tr->devs);
555 list_add(&tr->list, &blktrans_majors);
556
557 mtd_for_each_device(mtd)
558 if (mtd->type != MTD_ABSENT)
559 tr->add_mtd(tr, mtd);
560
561 mutex_unlock(&mtd_table_mutex);
562 return 0;
563 }
564
565 int deregister_mtd_blktrans(struct mtd_blktrans_ops *tr)
566 {
567 struct mtd_blktrans_dev *dev, *next;
568
569 mutex_lock(&mtd_table_mutex);
570
571 /* Remove it from the list of active majors */
572 list_del(&tr->list);
573
574 list_for_each_entry_safe(dev, next, &tr->devs, list)
575 tr->remove_dev(dev);
576
577 unregister_blkdev(tr->major, tr->name);
578 mutex_unlock(&mtd_table_mutex);
579
580 BUG_ON(!list_empty(&tr->devs));
581 return 0;
582 }
583
584 static void __exit mtd_blktrans_exit(void)
585 {
586 /* No race here -- if someone's currently in register_mtd_blktrans
587 we're screwed anyway. */
588 if (blktrans_notifier.list.next)
589 unregister_mtd_user(&blktrans_notifier);
590 }
591
592 module_exit(mtd_blktrans_exit);
593
594 EXPORT_SYMBOL_GPL(register_mtd_blktrans);
595 EXPORT_SYMBOL_GPL(deregister_mtd_blktrans);
596 EXPORT_SYMBOL_GPL(add_mtd_blktrans_dev);
597 EXPORT_SYMBOL_GPL(del_mtd_blktrans_dev);
598
599 MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
600 MODULE_LICENSE("GPL");
601 MODULE_DESCRIPTION("Common interface to block layer for MTD 'translation layers'");