1 // SPDX-License-Identifier: GPL-2.0-or-later
3 i2c-dev.c - i2c-bus driver, char device interface
5 Copyright (C) 1995-97 Simon G. Vogl
6 Copyright (C) 1998-99 Frodo Looijaard <frodol@dds.nl>
7 Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
11 /* Note that this is a complete rewrite of Simon Vogl's i2c-dev module.
12 But I have used so much of his original code and ideas that it seems
13 only fair to recognize him as co-author -- Frodo */
15 /* The I2C_RDWR ioctl code is written by Kolja Waschk <waschk@telos.de> */
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 #include <linux/cdev.h>
20 #include <linux/compat.h>
21 #include <linux/device.h>
23 #include <linux/i2c-dev.h>
24 #include <linux/i2c.h>
25 #include <linux/init.h>
26 #include <linux/jiffies.h>
27 #include <linux/kernel.h>
28 #include <linux/list.h>
29 #include <linux/module.h>
30 #include <linux/notifier.h>
31 #include <linux/slab.h>
32 #include <linux/uaccess.h>
35 * An i2c_dev represents an i2c_adapter ... an I2C or SMBus master, not a
36 * slave (i2c_client) with which messages will be exchanged. It's coupled
37 * with a character special file which is accessed by user mode drivers.
39 * The list of i2c_dev structures is parallel to the i2c_adapter lists
40 * maintained by the driver model, and is updated using bus notifications.
43 struct list_head list
;
44 struct i2c_adapter
*adap
;
49 #define I2C_MINORS (MINORMASK + 1)
50 static LIST_HEAD(i2c_dev_list
);
51 static DEFINE_SPINLOCK(i2c_dev_list_lock
);
53 static struct i2c_dev
*i2c_dev_get_by_minor(unsigned index
)
55 struct i2c_dev
*i2c_dev
;
57 spin_lock(&i2c_dev_list_lock
);
58 list_for_each_entry(i2c_dev
, &i2c_dev_list
, list
) {
59 if (i2c_dev
->adap
->nr
== index
)
64 spin_unlock(&i2c_dev_list_lock
);
68 static struct i2c_dev
*get_free_i2c_dev(struct i2c_adapter
*adap
)
70 struct i2c_dev
*i2c_dev
;
72 if (adap
->nr
>= I2C_MINORS
) {
73 pr_err("Out of device minors (%d)\n", adap
->nr
);
74 return ERR_PTR(-ENODEV
);
77 i2c_dev
= kzalloc(sizeof(*i2c_dev
), GFP_KERNEL
);
79 return ERR_PTR(-ENOMEM
);
82 spin_lock(&i2c_dev_list_lock
);
83 list_add_tail(&i2c_dev
->list
, &i2c_dev_list
);
84 spin_unlock(&i2c_dev_list_lock
);
88 static void put_i2c_dev(struct i2c_dev
*i2c_dev
, bool del_cdev
)
90 spin_lock(&i2c_dev_list_lock
);
91 list_del(&i2c_dev
->list
);
92 spin_unlock(&i2c_dev_list_lock
);
94 cdev_device_del(&i2c_dev
->cdev
, &i2c_dev
->dev
);
95 put_device(&i2c_dev
->dev
);
98 static ssize_t
name_show(struct device
*dev
,
99 struct device_attribute
*attr
, char *buf
)
101 struct i2c_dev
*i2c_dev
= i2c_dev_get_by_minor(MINOR(dev
->devt
));
105 return sysfs_emit(buf
, "%s\n", i2c_dev
->adap
->name
);
107 static DEVICE_ATTR_RO(name
);
109 static struct attribute
*i2c_attrs
[] = {
113 ATTRIBUTE_GROUPS(i2c
);
115 /* ------------------------------------------------------------------------- */
118 * After opening an instance of this character special file, a file
119 * descriptor starts out associated only with an i2c_adapter (and bus).
121 * Using the I2C_RDWR ioctl(), you can then *immediately* issue i2c_msg
122 * traffic to any devices on the bus used by that adapter. That's because
123 * the i2c_msg vectors embed all the addressing information they need, and
124 * are submitted directly to an i2c_adapter. However, SMBus-only adapters
125 * don't support that interface.
127 * To use read()/write() system calls on that file descriptor, or to use
128 * SMBus interfaces (and work with SMBus-only hosts!), you must first issue
129 * an I2C_SLAVE (or I2C_SLAVE_FORCE) ioctl. That configures an anonymous
130 * (never registered) i2c_client so it holds the addressing information
131 * needed by those system calls and by this SMBus interface.
134 static ssize_t
i2cdev_read(struct file
*file
, char __user
*buf
, size_t count
,
140 struct i2c_client
*client
= file
->private_data
;
142 /* Adapter must support I2C transfers */
143 if (!i2c_check_functionality(client
->adapter
, I2C_FUNC_I2C
))
149 tmp
= kzalloc(count
, GFP_KERNEL
);
153 pr_debug("i2c-%d reading %zu bytes.\n", iminor(file_inode(file
)), count
);
155 ret
= i2c_master_recv(client
, tmp
, count
);
157 if (copy_to_user(buf
, tmp
, ret
))
163 static ssize_t
i2cdev_write(struct file
*file
, const char __user
*buf
,
164 size_t count
, loff_t
*offset
)
168 struct i2c_client
*client
= file
->private_data
;
170 /* Adapter must support I2C transfers */
171 if (!i2c_check_functionality(client
->adapter
, I2C_FUNC_I2C
))
177 tmp
= memdup_user(buf
, count
);
181 pr_debug("i2c-%d writing %zu bytes.\n", iminor(file_inode(file
)), count
);
183 ret
= i2c_master_send(client
, tmp
, count
);
188 static int i2cdev_check(struct device
*dev
, void *addrp
)
190 struct i2c_client
*client
= i2c_verify_client(dev
);
192 if (!client
|| client
->addr
!= *(unsigned int *)addrp
)
195 return dev
->driver
? -EBUSY
: 0;
198 /* walk up mux tree */
199 static int i2cdev_check_mux_parents(struct i2c_adapter
*adapter
, int addr
)
201 struct i2c_adapter
*parent
= i2c_parent_is_i2c_adapter(adapter
);
204 result
= device_for_each_child(&adapter
->dev
, &addr
, i2cdev_check
);
205 if (!result
&& parent
)
206 result
= i2cdev_check_mux_parents(parent
, addr
);
211 /* recurse down mux tree */
212 static int i2cdev_check_mux_children(struct device
*dev
, void *addrp
)
216 if (dev
->type
== &i2c_adapter_type
)
217 result
= device_for_each_child(dev
, addrp
,
218 i2cdev_check_mux_children
);
220 result
= i2cdev_check(dev
, addrp
);
225 /* This address checking function differs from the one in i2c-core
226 in that it considers an address with a registered device, but no
227 driver bound to it, as NOT busy. */
228 static int i2cdev_check_addr(struct i2c_adapter
*adapter
, unsigned int addr
)
230 struct i2c_adapter
*parent
= i2c_parent_is_i2c_adapter(adapter
);
234 result
= i2cdev_check_mux_parents(parent
, addr
);
237 result
= device_for_each_child(&adapter
->dev
, &addr
,
238 i2cdev_check_mux_children
);
243 static noinline
int i2cdev_ioctl_rdwr(struct i2c_client
*client
,
244 unsigned nmsgs
, struct i2c_msg
*msgs
)
246 u8 __user
**data_ptrs
;
249 /* Adapter must support I2C transfers */
250 if (!i2c_check_functionality(client
->adapter
, I2C_FUNC_I2C
))
253 data_ptrs
= kmalloc_array(nmsgs
, sizeof(u8 __user
*), GFP_KERNEL
);
258 for (i
= 0; i
< nmsgs
; i
++) {
259 /* Limit the size of the message to a sane amount */
260 if (msgs
[i
].len
> 8192) {
265 data_ptrs
[i
] = (u8 __user
*)msgs
[i
].buf
;
266 msgs
[i
].buf
= memdup_user(data_ptrs
[i
], msgs
[i
].len
);
267 if (IS_ERR(msgs
[i
].buf
)) {
268 res
= PTR_ERR(msgs
[i
].buf
);
271 /* memdup_user allocates with GFP_KERNEL, so DMA is ok */
272 msgs
[i
].flags
|= I2C_M_DMA_SAFE
;
275 * If the message length is received from the slave (similar
276 * to SMBus block read), we must ensure that the buffer will
277 * be large enough to cope with a message length of
278 * I2C_SMBUS_BLOCK_MAX as this is the maximum underlying bus
279 * drivers allow. The first byte in the buffer must be
280 * pre-filled with the number of extra bytes, which must be
281 * at least one to hold the message length, but can be
282 * greater (for example to account for a checksum byte at
283 * the end of the message.)
285 if (msgs
[i
].flags
& I2C_M_RECV_LEN
) {
286 if (!(msgs
[i
].flags
& I2C_M_RD
) ||
287 msgs
[i
].len
< 1 || msgs
[i
].buf
[0] < 1 ||
288 msgs
[i
].len
< msgs
[i
].buf
[0] +
289 I2C_SMBUS_BLOCK_MAX
) {
295 msgs
[i
].len
= msgs
[i
].buf
[0];
300 for (j
= 0; j
< i
; ++j
)
306 res
= i2c_transfer(client
->adapter
, msgs
, nmsgs
);
308 if (res
>= 0 && (msgs
[i
].flags
& I2C_M_RD
)) {
309 if (copy_to_user(data_ptrs
[i
], msgs
[i
].buf
,
319 static noinline
int i2cdev_ioctl_smbus(struct i2c_client
*client
,
320 u8 read_write
, u8 command
, u32 size
,
321 union i2c_smbus_data __user
*data
)
323 union i2c_smbus_data temp
= {};
326 if ((size
!= I2C_SMBUS_BYTE
) &&
327 (size
!= I2C_SMBUS_QUICK
) &&
328 (size
!= I2C_SMBUS_BYTE_DATA
) &&
329 (size
!= I2C_SMBUS_WORD_DATA
) &&
330 (size
!= I2C_SMBUS_PROC_CALL
) &&
331 (size
!= I2C_SMBUS_BLOCK_DATA
) &&
332 (size
!= I2C_SMBUS_I2C_BLOCK_BROKEN
) &&
333 (size
!= I2C_SMBUS_I2C_BLOCK_DATA
) &&
334 (size
!= I2C_SMBUS_BLOCK_PROC_CALL
)) {
335 dev_dbg(&client
->adapter
->dev
,
336 "size out of range (%x) in ioctl I2C_SMBUS.\n",
340 /* Note that I2C_SMBUS_READ and I2C_SMBUS_WRITE are 0 and 1,
341 so the check is valid if size==I2C_SMBUS_QUICK too. */
342 if ((read_write
!= I2C_SMBUS_READ
) &&
343 (read_write
!= I2C_SMBUS_WRITE
)) {
344 dev_dbg(&client
->adapter
->dev
,
345 "read_write out of range (%x) in ioctl I2C_SMBUS.\n",
350 /* Note that command values are always valid! */
352 if ((size
== I2C_SMBUS_QUICK
) ||
353 ((size
== I2C_SMBUS_BYTE
) &&
354 (read_write
== I2C_SMBUS_WRITE
)))
355 /* These are special: we do not use data */
356 return i2c_smbus_xfer(client
->adapter
, client
->addr
,
357 client
->flags
, read_write
,
358 command
, size
, NULL
);
361 dev_dbg(&client
->adapter
->dev
,
362 "data is NULL pointer in ioctl I2C_SMBUS.\n");
366 if ((size
== I2C_SMBUS_BYTE_DATA
) ||
367 (size
== I2C_SMBUS_BYTE
))
368 datasize
= sizeof(data
->byte
);
369 else if ((size
== I2C_SMBUS_WORD_DATA
) ||
370 (size
== I2C_SMBUS_PROC_CALL
))
371 datasize
= sizeof(data
->word
);
372 else /* size == smbus block, i2c block, or block proc. call */
373 datasize
= sizeof(data
->block
);
375 if ((size
== I2C_SMBUS_PROC_CALL
) ||
376 (size
== I2C_SMBUS_BLOCK_PROC_CALL
) ||
377 (size
== I2C_SMBUS_I2C_BLOCK_DATA
) ||
378 (read_write
== I2C_SMBUS_WRITE
)) {
379 if (copy_from_user(&temp
, data
, datasize
))
382 if (size
== I2C_SMBUS_I2C_BLOCK_BROKEN
) {
383 /* Convert old I2C block commands to the new
384 convention. This preserves binary compatibility. */
385 size
= I2C_SMBUS_I2C_BLOCK_DATA
;
386 if (read_write
== I2C_SMBUS_READ
)
387 temp
.block
[0] = I2C_SMBUS_BLOCK_MAX
;
389 res
= i2c_smbus_xfer(client
->adapter
, client
->addr
, client
->flags
,
390 read_write
, command
, size
, &temp
);
391 if (!res
&& ((size
== I2C_SMBUS_PROC_CALL
) ||
392 (size
== I2C_SMBUS_BLOCK_PROC_CALL
) ||
393 (read_write
== I2C_SMBUS_READ
))) {
394 if (copy_to_user(data
, &temp
, datasize
))
400 static long i2cdev_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
402 struct i2c_client
*client
= file
->private_data
;
405 dev_dbg(&client
->adapter
->dev
, "ioctl, cmd=0x%02x, arg=0x%02lx\n",
410 case I2C_SLAVE_FORCE
:
412 (((client
->flags
& I2C_M_TEN
) == 0) && arg
> 0x7f))
414 if (cmd
== I2C_SLAVE
&& i2cdev_check_addr(client
->adapter
, arg
))
416 /* REVISIT: address could become busy later */
421 client
->flags
|= I2C_M_TEN
;
423 client
->flags
&= ~I2C_M_TEN
;
427 * Setting the PEC flag here won't affect kernel drivers,
428 * which will be using the i2c_client node registered with
429 * the driver model core. Likewise, when that client has
430 * the PEC flag already set, the i2c-dev driver won't see
431 * (or use) this setting.
434 client
->flags
|= I2C_CLIENT_PEC
;
436 client
->flags
&= ~I2C_CLIENT_PEC
;
439 funcs
= i2c_get_functionality(client
->adapter
);
440 return put_user(funcs
, (unsigned long __user
*)arg
);
443 struct i2c_rdwr_ioctl_data rdwr_arg
;
444 struct i2c_msg
*rdwr_pa
;
447 if (copy_from_user(&rdwr_arg
,
448 (struct i2c_rdwr_ioctl_data __user
*)arg
,
452 if (!rdwr_arg
.msgs
|| rdwr_arg
.nmsgs
== 0)
456 * Put an arbitrary limit on the number of messages that can
459 if (rdwr_arg
.nmsgs
> I2C_RDWR_IOCTL_MAX_MSGS
)
462 rdwr_pa
= memdup_array_user(rdwr_arg
.msgs
,
463 rdwr_arg
.nmsgs
, sizeof(struct i2c_msg
));
465 return PTR_ERR(rdwr_pa
);
467 res
= i2cdev_ioctl_rdwr(client
, rdwr_arg
.nmsgs
, rdwr_pa
);
473 struct i2c_smbus_ioctl_data data_arg
;
474 if (copy_from_user(&data_arg
,
475 (struct i2c_smbus_ioctl_data __user
*) arg
,
476 sizeof(struct i2c_smbus_ioctl_data
)))
478 return i2cdev_ioctl_smbus(client
, data_arg
.read_write
,
487 client
->adapter
->retries
= arg
;
493 /* For historical reasons, user-space sets the timeout
494 * value in units of 10 ms.
496 client
->adapter
->timeout
= msecs_to_jiffies(arg
* 10);
499 /* NOTE: returning a fault code here could cause trouble
500 * in buggy userspace code. Some old kernel bugs returned
501 * zero in this case, and userspace code might accidentally
502 * have depended on that bug.
511 struct i2c_smbus_ioctl_data32
{
515 compat_caddr_t data
; /* union i2c_smbus_data *data */
525 struct i2c_rdwr_ioctl_data32
{
526 compat_caddr_t msgs
; /* struct i2c_msg __user *msgs */
530 static long compat_i2cdev_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
532 struct i2c_client
*client
= file
->private_data
;
536 funcs
= i2c_get_functionality(client
->adapter
);
537 return put_user(funcs
, (compat_ulong_t __user
*)arg
);
539 struct i2c_rdwr_ioctl_data32 rdwr_arg
;
540 struct i2c_msg32 __user
*p
;
541 struct i2c_msg
*rdwr_pa
;
544 if (copy_from_user(&rdwr_arg
,
545 (struct i2c_rdwr_ioctl_data32 __user
*)arg
,
549 if (!rdwr_arg
.msgs
|| rdwr_arg
.nmsgs
== 0)
552 if (rdwr_arg
.nmsgs
> I2C_RDWR_IOCTL_MAX_MSGS
)
555 rdwr_pa
= kmalloc_array(rdwr_arg
.nmsgs
, sizeof(struct i2c_msg
),
560 p
= compat_ptr(rdwr_arg
.msgs
);
561 for (i
= 0; i
< rdwr_arg
.nmsgs
; i
++) {
562 struct i2c_msg32 umsg
;
563 if (copy_from_user(&umsg
, p
+ i
, sizeof(umsg
))) {
567 rdwr_pa
[i
] = (struct i2c_msg
) {
571 .buf
= (__force __u8
*)compat_ptr(umsg
.buf
),
575 res
= i2cdev_ioctl_rdwr(client
, rdwr_arg
.nmsgs
, rdwr_pa
);
580 struct i2c_smbus_ioctl_data32 data32
;
581 if (copy_from_user(&data32
,
585 return i2cdev_ioctl_smbus(client
, data32
.read_write
,
588 compat_ptr(data32
.data
));
591 return i2cdev_ioctl(file
, cmd
, arg
);
595 #define compat_i2cdev_ioctl NULL
598 static int i2cdev_open(struct inode
*inode
, struct file
*file
)
600 unsigned int minor
= iminor(inode
);
601 struct i2c_client
*client
;
602 struct i2c_adapter
*adap
;
604 adap
= i2c_get_adapter(minor
);
608 /* This creates an anonymous i2c_client, which may later be
609 * pointed to some address using I2C_SLAVE or I2C_SLAVE_FORCE.
611 * This client is ** NEVER REGISTERED ** with the driver model
612 * or I2C core code!! It just holds private copies of addressing
613 * information and maybe a PEC flag.
615 client
= kzalloc(sizeof(*client
), GFP_KERNEL
);
617 i2c_put_adapter(adap
);
620 snprintf(client
->name
, I2C_NAME_SIZE
, "i2c-dev %d", adap
->nr
);
622 client
->adapter
= adap
;
623 file
->private_data
= client
;
628 static int i2cdev_release(struct inode
*inode
, struct file
*file
)
630 struct i2c_client
*client
= file
->private_data
;
632 i2c_put_adapter(client
->adapter
);
634 file
->private_data
= NULL
;
639 static const struct file_operations i2cdev_fops
= {
640 .owner
= THIS_MODULE
,
642 .write
= i2cdev_write
,
643 .unlocked_ioctl
= i2cdev_ioctl
,
644 .compat_ioctl
= compat_i2cdev_ioctl
,
646 .release
= i2cdev_release
,
649 /* ------------------------------------------------------------------------- */
651 static const struct class i2c_dev_class
= {
653 .dev_groups
= i2c_groups
,
656 static void i2cdev_dev_release(struct device
*dev
)
658 struct i2c_dev
*i2c_dev
;
660 i2c_dev
= container_of(dev
, struct i2c_dev
, dev
);
664 static int i2cdev_attach_adapter(struct device
*dev
)
666 struct i2c_adapter
*adap
;
667 struct i2c_dev
*i2c_dev
;
670 if (dev
->type
!= &i2c_adapter_type
)
672 adap
= to_i2c_adapter(dev
);
674 i2c_dev
= get_free_i2c_dev(adap
);
678 cdev_init(&i2c_dev
->cdev
, &i2cdev_fops
);
679 i2c_dev
->cdev
.owner
= THIS_MODULE
;
681 device_initialize(&i2c_dev
->dev
);
682 i2c_dev
->dev
.devt
= MKDEV(I2C_MAJOR
, adap
->nr
);
683 i2c_dev
->dev
.class = &i2c_dev_class
;
684 i2c_dev
->dev
.parent
= &adap
->dev
;
685 i2c_dev
->dev
.release
= i2cdev_dev_release
;
687 res
= dev_set_name(&i2c_dev
->dev
, "i2c-%d", adap
->nr
);
689 goto err_put_i2c_dev
;
691 res
= cdev_device_add(&i2c_dev
->cdev
, &i2c_dev
->dev
);
693 goto err_put_i2c_dev
;
695 pr_debug("adapter [%s] registered as minor %d\n", adap
->name
, adap
->nr
);
699 put_i2c_dev(i2c_dev
, false);
703 static int i2cdev_detach_adapter(struct device
*dev
)
705 struct i2c_adapter
*adap
;
706 struct i2c_dev
*i2c_dev
;
708 if (dev
->type
!= &i2c_adapter_type
)
710 adap
= to_i2c_adapter(dev
);
712 i2c_dev
= i2c_dev_get_by_minor(adap
->nr
);
713 if (!i2c_dev
) /* attach_adapter must have failed */
716 put_i2c_dev(i2c_dev
, true);
718 pr_debug("adapter [%s] unregistered\n", adap
->name
);
722 static int i2cdev_notifier_call(struct notifier_block
*nb
, unsigned long action
,
725 struct device
*dev
= data
;
728 case BUS_NOTIFY_ADD_DEVICE
:
729 return i2cdev_attach_adapter(dev
);
730 case BUS_NOTIFY_DEL_DEVICE
:
731 return i2cdev_detach_adapter(dev
);
737 static struct notifier_block i2cdev_notifier
= {
738 .notifier_call
= i2cdev_notifier_call
,
741 /* ------------------------------------------------------------------------- */
743 static int __init
i2c_dev_attach_adapter(struct device
*dev
, void *dummy
)
745 i2cdev_attach_adapter(dev
);
749 static int __exit
i2c_dev_detach_adapter(struct device
*dev
, void *dummy
)
751 i2cdev_detach_adapter(dev
);
756 * module load/unload record keeping
759 static int __init
i2c_dev_init(void)
763 pr_info("i2c /dev entries driver\n");
765 res
= register_chrdev_region(MKDEV(I2C_MAJOR
, 0), I2C_MINORS
, "i2c");
769 res
= class_register(&i2c_dev_class
);
771 goto out_unreg_chrdev
;
773 /* Keep track of adapters which will be added or removed later */
774 res
= bus_register_notifier(&i2c_bus_type
, &i2cdev_notifier
);
776 goto out_unreg_class
;
778 /* Bind to already existing adapters right away */
779 i2c_for_each_dev(NULL
, i2c_dev_attach_adapter
);
784 class_unregister(&i2c_dev_class
);
786 unregister_chrdev_region(MKDEV(I2C_MAJOR
, 0), I2C_MINORS
);
788 pr_err("Driver Initialisation failed\n");
792 static void __exit
i2c_dev_exit(void)
794 bus_unregister_notifier(&i2c_bus_type
, &i2cdev_notifier
);
795 i2c_for_each_dev(NULL
, i2c_dev_detach_adapter
);
796 class_unregister(&i2c_dev_class
);
797 unregister_chrdev_region(MKDEV(I2C_MAJOR
, 0), I2C_MINORS
);
800 MODULE_AUTHOR("Frodo Looijaard <frodol@dds.nl>");
801 MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
802 MODULE_DESCRIPTION("I2C /dev entries driver");
803 MODULE_LICENSE("GPL");
805 module_init(i2c_dev_init
);
806 module_exit(i2c_dev_exit
);