1 // SPDX-License-Identifier: GPL-2.0-or-later
3 i2c-dev.c - i2c-bus driver, char device interface
5 Copyright (C) 1995-97 Simon G. Vogl
6 Copyright (C) 1998-99 Frodo Looijaard <frodol@dds.nl>
7 Copyright (C) 2003 Greg Kroah-Hartman <greg@kroah.com>
11 /* Note that this is a complete rewrite of Simon Vogl's i2c-dev module.
12 But I have used so much of his original code and ideas that it seems
13 only fair to recognize him as co-author -- Frodo */
15 /* The I2C_RDWR ioctl code is written by Kolja Waschk <waschk@telos.de> */
17 #include <linux/cdev.h>
18 #include <linux/device.h>
20 #include <linux/i2c-dev.h>
21 #include <linux/i2c.h>
22 #include <linux/init.h>
23 #include <linux/jiffies.h>
24 #include <linux/kernel.h>
25 #include <linux/list.h>
26 #include <linux/module.h>
27 #include <linux/notifier.h>
28 #include <linux/slab.h>
29 #include <linux/uaccess.h>
30 #include <linux/compat.h>
33 * An i2c_dev represents an i2c_adapter ... an I2C or SMBus master, not a
34 * slave (i2c_client) with which messages will be exchanged. It's coupled
35 * with a character special file which is accessed by user mode drivers.
37 * The list of i2c_dev structures is parallel to the i2c_adapter lists
38 * maintained by the driver model, and is updated using bus notifications.
41 struct list_head list
;
42 struct i2c_adapter
*adap
;
47 #define I2C_MINORS (MINORMASK + 1)
48 static LIST_HEAD(i2c_dev_list
);
49 static DEFINE_SPINLOCK(i2c_dev_list_lock
);
51 static struct i2c_dev
*i2c_dev_get_by_minor(unsigned index
)
53 struct i2c_dev
*i2c_dev
;
55 spin_lock(&i2c_dev_list_lock
);
56 list_for_each_entry(i2c_dev
, &i2c_dev_list
, list
) {
57 if (i2c_dev
->adap
->nr
== index
)
62 spin_unlock(&i2c_dev_list_lock
);
66 static struct i2c_dev
*get_free_i2c_dev(struct i2c_adapter
*adap
)
68 struct i2c_dev
*i2c_dev
;
70 if (adap
->nr
>= I2C_MINORS
) {
71 printk(KERN_ERR
"i2c-dev: Out of device minors (%d)\n",
73 return ERR_PTR(-ENODEV
);
76 i2c_dev
= kzalloc(sizeof(*i2c_dev
), GFP_KERNEL
);
78 return ERR_PTR(-ENOMEM
);
81 spin_lock(&i2c_dev_list_lock
);
82 list_add_tail(&i2c_dev
->list
, &i2c_dev_list
);
83 spin_unlock(&i2c_dev_list_lock
);
87 static void put_i2c_dev(struct i2c_dev
*i2c_dev
)
89 spin_lock(&i2c_dev_list_lock
);
90 list_del(&i2c_dev
->list
);
91 spin_unlock(&i2c_dev_list_lock
);
95 static ssize_t
name_show(struct device
*dev
,
96 struct device_attribute
*attr
, char *buf
)
98 struct i2c_dev
*i2c_dev
= i2c_dev_get_by_minor(MINOR(dev
->devt
));
102 return sprintf(buf
, "%s\n", i2c_dev
->adap
->name
);
104 static DEVICE_ATTR_RO(name
);
106 static struct attribute
*i2c_attrs
[] = {
110 ATTRIBUTE_GROUPS(i2c
);
112 /* ------------------------------------------------------------------------- */
115 * After opening an instance of this character special file, a file
116 * descriptor starts out associated only with an i2c_adapter (and bus).
118 * Using the I2C_RDWR ioctl(), you can then *immediately* issue i2c_msg
119 * traffic to any devices on the bus used by that adapter. That's because
120 * the i2c_msg vectors embed all the addressing information they need, and
121 * are submitted directly to an i2c_adapter. However, SMBus-only adapters
122 * don't support that interface.
124 * To use read()/write() system calls on that file descriptor, or to use
125 * SMBus interfaces (and work with SMBus-only hosts!), you must first issue
126 * an I2C_SLAVE (or I2C_SLAVE_FORCE) ioctl. That configures an anonymous
127 * (never registered) i2c_client so it holds the addressing information
128 * needed by those system calls and by this SMBus interface.
131 static ssize_t
i2cdev_read(struct file
*file
, char __user
*buf
, size_t count
,
137 struct i2c_client
*client
= file
->private_data
;
142 tmp
= kmalloc(count
, GFP_KERNEL
);
146 pr_debug("i2c-dev: i2c-%d reading %zu bytes.\n",
147 iminor(file_inode(file
)), count
);
149 ret
= i2c_master_recv(client
, tmp
, count
);
151 ret
= copy_to_user(buf
, tmp
, count
) ? -EFAULT
: ret
;
156 static ssize_t
i2cdev_write(struct file
*file
, const char __user
*buf
,
157 size_t count
, loff_t
*offset
)
161 struct i2c_client
*client
= file
->private_data
;
166 tmp
= memdup_user(buf
, count
);
170 pr_debug("i2c-dev: i2c-%d writing %zu bytes.\n",
171 iminor(file_inode(file
)), count
);
173 ret
= i2c_master_send(client
, tmp
, count
);
178 static int i2cdev_check(struct device
*dev
, void *addrp
)
180 struct i2c_client
*client
= i2c_verify_client(dev
);
182 if (!client
|| client
->addr
!= *(unsigned int *)addrp
)
185 return dev
->driver
? -EBUSY
: 0;
188 /* walk up mux tree */
189 static int i2cdev_check_mux_parents(struct i2c_adapter
*adapter
, int addr
)
191 struct i2c_adapter
*parent
= i2c_parent_is_i2c_adapter(adapter
);
194 result
= device_for_each_child(&adapter
->dev
, &addr
, i2cdev_check
);
195 if (!result
&& parent
)
196 result
= i2cdev_check_mux_parents(parent
, addr
);
201 /* recurse down mux tree */
202 static int i2cdev_check_mux_children(struct device
*dev
, void *addrp
)
206 if (dev
->type
== &i2c_adapter_type
)
207 result
= device_for_each_child(dev
, addrp
,
208 i2cdev_check_mux_children
);
210 result
= i2cdev_check(dev
, addrp
);
215 /* This address checking function differs from the one in i2c-core
216 in that it considers an address with a registered device, but no
217 driver bound to it, as NOT busy. */
218 static int i2cdev_check_addr(struct i2c_adapter
*adapter
, unsigned int addr
)
220 struct i2c_adapter
*parent
= i2c_parent_is_i2c_adapter(adapter
);
224 result
= i2cdev_check_mux_parents(parent
, addr
);
227 result
= device_for_each_child(&adapter
->dev
, &addr
,
228 i2cdev_check_mux_children
);
233 static noinline
int i2cdev_ioctl_rdwr(struct i2c_client
*client
,
234 unsigned nmsgs
, struct i2c_msg
*msgs
)
236 u8 __user
**data_ptrs
;
239 data_ptrs
= kmalloc_array(nmsgs
, sizeof(u8 __user
*), GFP_KERNEL
);
240 if (data_ptrs
== NULL
) {
246 for (i
= 0; i
< nmsgs
; i
++) {
247 /* Limit the size of the message to a sane amount */
248 if (msgs
[i
].len
> 8192) {
253 data_ptrs
[i
] = (u8 __user
*)msgs
[i
].buf
;
254 msgs
[i
].buf
= memdup_user(data_ptrs
[i
], msgs
[i
].len
);
255 if (IS_ERR(msgs
[i
].buf
)) {
256 res
= PTR_ERR(msgs
[i
].buf
);
259 /* memdup_user allocates with GFP_KERNEL, so DMA is ok */
260 msgs
[i
].flags
|= I2C_M_DMA_SAFE
;
263 * If the message length is received from the slave (similar
264 * to SMBus block read), we must ensure that the buffer will
265 * be large enough to cope with a message length of
266 * I2C_SMBUS_BLOCK_MAX as this is the maximum underlying bus
267 * drivers allow. The first byte in the buffer must be
268 * pre-filled with the number of extra bytes, which must be
269 * at least one to hold the message length, but can be
270 * greater (for example to account for a checksum byte at
271 * the end of the message.)
273 if (msgs
[i
].flags
& I2C_M_RECV_LEN
) {
274 if (!(msgs
[i
].flags
& I2C_M_RD
) ||
275 msgs
[i
].len
< 1 || msgs
[i
].buf
[0] < 1 ||
276 msgs
[i
].len
< msgs
[i
].buf
[0] +
277 I2C_SMBUS_BLOCK_MAX
) {
283 msgs
[i
].len
= msgs
[i
].buf
[0];
288 for (j
= 0; j
< i
; ++j
)
295 res
= i2c_transfer(client
->adapter
, msgs
, nmsgs
);
297 if (res
>= 0 && (msgs
[i
].flags
& I2C_M_RD
)) {
298 if (copy_to_user(data_ptrs
[i
], msgs
[i
].buf
,
309 static noinline
int i2cdev_ioctl_smbus(struct i2c_client
*client
,
310 u8 read_write
, u8 command
, u32 size
,
311 union i2c_smbus_data __user
*data
)
313 union i2c_smbus_data temp
= {};
316 if ((size
!= I2C_SMBUS_BYTE
) &&
317 (size
!= I2C_SMBUS_QUICK
) &&
318 (size
!= I2C_SMBUS_BYTE_DATA
) &&
319 (size
!= I2C_SMBUS_WORD_DATA
) &&
320 (size
!= I2C_SMBUS_PROC_CALL
) &&
321 (size
!= I2C_SMBUS_BLOCK_DATA
) &&
322 (size
!= I2C_SMBUS_I2C_BLOCK_BROKEN
) &&
323 (size
!= I2C_SMBUS_I2C_BLOCK_DATA
) &&
324 (size
!= I2C_SMBUS_BLOCK_PROC_CALL
)) {
325 dev_dbg(&client
->adapter
->dev
,
326 "size out of range (%x) in ioctl I2C_SMBUS.\n",
330 /* Note that I2C_SMBUS_READ and I2C_SMBUS_WRITE are 0 and 1,
331 so the check is valid if size==I2C_SMBUS_QUICK too. */
332 if ((read_write
!= I2C_SMBUS_READ
) &&
333 (read_write
!= I2C_SMBUS_WRITE
)) {
334 dev_dbg(&client
->adapter
->dev
,
335 "read_write out of range (%x) in ioctl I2C_SMBUS.\n",
340 /* Note that command values are always valid! */
342 if ((size
== I2C_SMBUS_QUICK
) ||
343 ((size
== I2C_SMBUS_BYTE
) &&
344 (read_write
== I2C_SMBUS_WRITE
)))
345 /* These are special: we do not use data */
346 return i2c_smbus_xfer(client
->adapter
, client
->addr
,
347 client
->flags
, read_write
,
348 command
, size
, NULL
);
351 dev_dbg(&client
->adapter
->dev
,
352 "data is NULL pointer in ioctl I2C_SMBUS.\n");
356 if ((size
== I2C_SMBUS_BYTE_DATA
) ||
357 (size
== I2C_SMBUS_BYTE
))
358 datasize
= sizeof(data
->byte
);
359 else if ((size
== I2C_SMBUS_WORD_DATA
) ||
360 (size
== I2C_SMBUS_PROC_CALL
))
361 datasize
= sizeof(data
->word
);
362 else /* size == smbus block, i2c block, or block proc. call */
363 datasize
= sizeof(data
->block
);
365 if ((size
== I2C_SMBUS_PROC_CALL
) ||
366 (size
== I2C_SMBUS_BLOCK_PROC_CALL
) ||
367 (size
== I2C_SMBUS_I2C_BLOCK_DATA
) ||
368 (read_write
== I2C_SMBUS_WRITE
)) {
369 if (copy_from_user(&temp
, data
, datasize
))
372 if (size
== I2C_SMBUS_I2C_BLOCK_BROKEN
) {
373 /* Convert old I2C block commands to the new
374 convention. This preserves binary compatibility. */
375 size
= I2C_SMBUS_I2C_BLOCK_DATA
;
376 if (read_write
== I2C_SMBUS_READ
)
377 temp
.block
[0] = I2C_SMBUS_BLOCK_MAX
;
379 res
= i2c_smbus_xfer(client
->adapter
, client
->addr
, client
->flags
,
380 read_write
, command
, size
, &temp
);
381 if (!res
&& ((size
== I2C_SMBUS_PROC_CALL
) ||
382 (size
== I2C_SMBUS_BLOCK_PROC_CALL
) ||
383 (read_write
== I2C_SMBUS_READ
))) {
384 if (copy_to_user(data
, &temp
, datasize
))
390 static long i2cdev_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
392 struct i2c_client
*client
= file
->private_data
;
395 dev_dbg(&client
->adapter
->dev
, "ioctl, cmd=0x%02x, arg=0x%02lx\n",
400 case I2C_SLAVE_FORCE
:
402 (((client
->flags
& I2C_M_TEN
) == 0) && arg
> 0x7f))
404 if (cmd
== I2C_SLAVE
&& i2cdev_check_addr(client
->adapter
, arg
))
406 /* REVISIT: address could become busy later */
411 client
->flags
|= I2C_M_TEN
;
413 client
->flags
&= ~I2C_M_TEN
;
417 * Setting the PEC flag here won't affect kernel drivers,
418 * which will be using the i2c_client node registered with
419 * the driver model core. Likewise, when that client has
420 * the PEC flag already set, the i2c-dev driver won't see
421 * (or use) this setting.
424 client
->flags
|= I2C_CLIENT_PEC
;
426 client
->flags
&= ~I2C_CLIENT_PEC
;
429 funcs
= i2c_get_functionality(client
->adapter
);
430 return put_user(funcs
, (unsigned long __user
*)arg
);
433 struct i2c_rdwr_ioctl_data rdwr_arg
;
434 struct i2c_msg
*rdwr_pa
;
436 if (copy_from_user(&rdwr_arg
,
437 (struct i2c_rdwr_ioctl_data __user
*)arg
,
441 /* Put an arbitrary limit on the number of messages that can
443 if (rdwr_arg
.nmsgs
> I2C_RDWR_IOCTL_MAX_MSGS
)
446 rdwr_pa
= memdup_user(rdwr_arg
.msgs
,
447 rdwr_arg
.nmsgs
* sizeof(struct i2c_msg
));
449 return PTR_ERR(rdwr_pa
);
451 return i2cdev_ioctl_rdwr(client
, rdwr_arg
.nmsgs
, rdwr_pa
);
455 struct i2c_smbus_ioctl_data data_arg
;
456 if (copy_from_user(&data_arg
,
457 (struct i2c_smbus_ioctl_data __user
*) arg
,
458 sizeof(struct i2c_smbus_ioctl_data
)))
460 return i2cdev_ioctl_smbus(client
, data_arg
.read_write
,
469 client
->adapter
->retries
= arg
;
475 /* For historical reasons, user-space sets the timeout
476 * value in units of 10 ms.
478 client
->adapter
->timeout
= msecs_to_jiffies(arg
* 10);
481 /* NOTE: returning a fault code here could cause trouble
482 * in buggy userspace code. Some old kernel bugs returned
483 * zero in this case, and userspace code might accidentally
484 * have depended on that bug.
493 struct i2c_smbus_ioctl_data32
{
497 compat_caddr_t data
; /* union i2c_smbus_data *data */
507 struct i2c_rdwr_ioctl_data32
{
508 compat_caddr_t msgs
; /* struct i2c_msg __user *msgs */
512 static long compat_i2cdev_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
514 struct i2c_client
*client
= file
->private_data
;
518 funcs
= i2c_get_functionality(client
->adapter
);
519 return put_user(funcs
, (compat_ulong_t __user
*)arg
);
521 struct i2c_rdwr_ioctl_data32 rdwr_arg
;
523 struct i2c_msg
*rdwr_pa
;
526 if (copy_from_user(&rdwr_arg
,
527 (struct i2c_rdwr_ioctl_data32 __user
*)arg
,
531 if (rdwr_arg
.nmsgs
> I2C_RDWR_IOCTL_MAX_MSGS
)
534 rdwr_pa
= kmalloc_array(rdwr_arg
.nmsgs
, sizeof(struct i2c_msg
),
539 p
= compat_ptr(rdwr_arg
.msgs
);
540 for (i
= 0; i
< rdwr_arg
.nmsgs
; i
++) {
541 struct i2c_msg32 umsg
;
542 if (copy_from_user(&umsg
, p
+ i
, sizeof(umsg
))) {
546 rdwr_pa
[i
] = (struct i2c_msg
) {
550 .buf
= compat_ptr(umsg
.buf
)
554 return i2cdev_ioctl_rdwr(client
, rdwr_arg
.nmsgs
, rdwr_pa
);
557 struct i2c_smbus_ioctl_data32 data32
;
558 if (copy_from_user(&data32
,
562 return i2cdev_ioctl_smbus(client
, data32
.read_write
,
565 compat_ptr(data32
.data
));
568 return i2cdev_ioctl(file
, cmd
, arg
);
572 #define compat_i2cdev_ioctl NULL
575 static int i2cdev_open(struct inode
*inode
, struct file
*file
)
577 unsigned int minor
= iminor(inode
);
578 struct i2c_client
*client
;
579 struct i2c_adapter
*adap
;
581 adap
= i2c_get_adapter(minor
);
585 /* This creates an anonymous i2c_client, which may later be
586 * pointed to some address using I2C_SLAVE or I2C_SLAVE_FORCE.
588 * This client is ** NEVER REGISTERED ** with the driver model
589 * or I2C core code!! It just holds private copies of addressing
590 * information and maybe a PEC flag.
592 client
= kzalloc(sizeof(*client
), GFP_KERNEL
);
594 i2c_put_adapter(adap
);
597 snprintf(client
->name
, I2C_NAME_SIZE
, "i2c-dev %d", adap
->nr
);
599 client
->adapter
= adap
;
600 file
->private_data
= client
;
605 static int i2cdev_release(struct inode
*inode
, struct file
*file
)
607 struct i2c_client
*client
= file
->private_data
;
609 i2c_put_adapter(client
->adapter
);
611 file
->private_data
= NULL
;
616 static const struct file_operations i2cdev_fops
= {
617 .owner
= THIS_MODULE
,
620 .write
= i2cdev_write
,
621 .unlocked_ioctl
= i2cdev_ioctl
,
622 .compat_ioctl
= compat_i2cdev_ioctl
,
624 .release
= i2cdev_release
,
627 /* ------------------------------------------------------------------------- */
629 static struct class *i2c_dev_class
;
631 static int i2cdev_attach_adapter(struct device
*dev
, void *dummy
)
633 struct i2c_adapter
*adap
;
634 struct i2c_dev
*i2c_dev
;
637 if (dev
->type
!= &i2c_adapter_type
)
639 adap
= to_i2c_adapter(dev
);
641 i2c_dev
= get_free_i2c_dev(adap
);
643 return PTR_ERR(i2c_dev
);
645 cdev_init(&i2c_dev
->cdev
, &i2cdev_fops
);
646 i2c_dev
->cdev
.owner
= THIS_MODULE
;
647 res
= cdev_add(&i2c_dev
->cdev
, MKDEV(I2C_MAJOR
, adap
->nr
), 1);
651 /* register this i2c device with the driver core */
652 i2c_dev
->dev
= device_create(i2c_dev_class
, &adap
->dev
,
653 MKDEV(I2C_MAJOR
, adap
->nr
), NULL
,
655 if (IS_ERR(i2c_dev
->dev
)) {
656 res
= PTR_ERR(i2c_dev
->dev
);
660 pr_debug("i2c-dev: adapter [%s] registered as minor %d\n",
661 adap
->name
, adap
->nr
);
664 cdev_del(&i2c_dev
->cdev
);
666 put_i2c_dev(i2c_dev
);
670 static int i2cdev_detach_adapter(struct device
*dev
, void *dummy
)
672 struct i2c_adapter
*adap
;
673 struct i2c_dev
*i2c_dev
;
675 if (dev
->type
!= &i2c_adapter_type
)
677 adap
= to_i2c_adapter(dev
);
679 i2c_dev
= i2c_dev_get_by_minor(adap
->nr
);
680 if (!i2c_dev
) /* attach_adapter must have failed */
683 cdev_del(&i2c_dev
->cdev
);
684 put_i2c_dev(i2c_dev
);
685 device_destroy(i2c_dev_class
, MKDEV(I2C_MAJOR
, adap
->nr
));
687 pr_debug("i2c-dev: adapter [%s] unregistered\n", adap
->name
);
691 static int i2cdev_notifier_call(struct notifier_block
*nb
, unsigned long action
,
694 struct device
*dev
= data
;
697 case BUS_NOTIFY_ADD_DEVICE
:
698 return i2cdev_attach_adapter(dev
, NULL
);
699 case BUS_NOTIFY_DEL_DEVICE
:
700 return i2cdev_detach_adapter(dev
, NULL
);
706 static struct notifier_block i2cdev_notifier
= {
707 .notifier_call
= i2cdev_notifier_call
,
710 /* ------------------------------------------------------------------------- */
713 * module load/unload record keeping
716 static int __init
i2c_dev_init(void)
720 printk(KERN_INFO
"i2c /dev entries driver\n");
722 res
= register_chrdev_region(MKDEV(I2C_MAJOR
, 0), I2C_MINORS
, "i2c");
726 i2c_dev_class
= class_create(THIS_MODULE
, "i2c-dev");
727 if (IS_ERR(i2c_dev_class
)) {
728 res
= PTR_ERR(i2c_dev_class
);
729 goto out_unreg_chrdev
;
731 i2c_dev_class
->dev_groups
= i2c_groups
;
733 /* Keep track of adapters which will be added or removed later */
734 res
= bus_register_notifier(&i2c_bus_type
, &i2cdev_notifier
);
736 goto out_unreg_class
;
738 /* Bind to already existing adapters right away */
739 i2c_for_each_dev(NULL
, i2cdev_attach_adapter
);
744 class_destroy(i2c_dev_class
);
746 unregister_chrdev_region(MKDEV(I2C_MAJOR
, 0), I2C_MINORS
);
748 printk(KERN_ERR
"%s: Driver Initialisation failed\n", __FILE__
);
752 static void __exit
i2c_dev_exit(void)
754 bus_unregister_notifier(&i2c_bus_type
, &i2cdev_notifier
);
755 i2c_for_each_dev(NULL
, i2cdev_detach_adapter
);
756 class_destroy(i2c_dev_class
);
757 unregister_chrdev_region(MKDEV(I2C_MAJOR
, 0), I2C_MINORS
);
760 MODULE_AUTHOR("Frodo Looijaard <frodol@dds.nl> and "
761 "Simon G. Vogl <simon@tk.uni-linz.ac.at>");
762 MODULE_DESCRIPTION("I2C /dev entries driver");
763 MODULE_LICENSE("GPL");
765 module_init(i2c_dev_init
);
766 module_exit(i2c_dev_exit
);