Annotation of /trunk/kernel-alx/patches-3.10/0113-3.10.14-all-fixes.patch
Parent Directory | Revision Log
Revision 2341 -
(hide annotations)
(download)
Mon Dec 16 10:04:13 2013 UTC (10 years, 9 months ago) by niro
File size: 88258 byte(s)
Mon Dec 16 10:04:13 2013 UTC (10 years, 9 months ago) by niro
File size: 88258 byte(s)
-linux-3.10.14
1 | niro | 2341 | diff --git a/Makefile b/Makefile |
2 | index 25d38b7..129c49f 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 3 | ||
7 | PATCHLEVEL = 10 | ||
8 | -SUBLEVEL = 13 | ||
9 | +SUBLEVEL = 14 | ||
10 | EXTRAVERSION = | ||
11 | NAME = TOSSUG Baby Fish | ||
12 | |||
13 | diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c | ||
14 | index d5bbdcf..c410752 100644 | ||
15 | --- a/block/cfq-iosched.c | ||
16 | +++ b/block/cfq-iosched.c | ||
17 | @@ -1803,7 +1803,7 @@ static u64 cfqg_prfill_avg_queue_size(struct seq_file *sf, | ||
18 | |||
19 | if (samples) { | ||
20 | v = blkg_stat_read(&cfqg->stats.avg_queue_size_sum); | ||
21 | - do_div(v, samples); | ||
22 | + v = div64_u64(v, samples); | ||
23 | } | ||
24 | __blkg_prfill_u64(sf, pd, v); | ||
25 | return 0; | ||
26 | diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h | ||
27 | index 02e52d5..b6b7d70 100644 | ||
28 | --- a/drivers/gpu/drm/ast/ast_drv.h | ||
29 | +++ b/drivers/gpu/drm/ast/ast_drv.h | ||
30 | @@ -177,7 +177,7 @@ uint8_t ast_get_index_reg_mask(struct ast_private *ast, | ||
31 | |||
32 | static inline void ast_open_key(struct ast_private *ast) | ||
33 | { | ||
34 | - ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xA1, 0xFF, 0x04); | ||
35 | + ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0x80, 0xA8); | ||
36 | } | ||
37 | |||
38 | #define AST_VIDMEM_SIZE_8M 0x00800000 | ||
39 | diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c | ||
40 | index e7e9242..8759d69 100644 | ||
41 | --- a/drivers/gpu/drm/drm_crtc.c | ||
42 | +++ b/drivers/gpu/drm/drm_crtc.c | ||
43 | @@ -2501,10 +2501,22 @@ int drm_mode_getfb(struct drm_device *dev, | ||
44 | r->depth = fb->depth; | ||
45 | r->bpp = fb->bits_per_pixel; | ||
46 | r->pitch = fb->pitches[0]; | ||
47 | - if (fb->funcs->create_handle) | ||
48 | - ret = fb->funcs->create_handle(fb, file_priv, &r->handle); | ||
49 | - else | ||
50 | + if (fb->funcs->create_handle) { | ||
51 | + if (file_priv->is_master || capable(CAP_SYS_ADMIN)) { | ||
52 | + ret = fb->funcs->create_handle(fb, file_priv, | ||
53 | + &r->handle); | ||
54 | + } else { | ||
55 | + /* GET_FB() is an unprivileged ioctl so we must not | ||
56 | + * return a buffer-handle to non-master processes! For | ||
57 | + * backwards-compatibility reasons, we cannot make | ||
58 | + * GET_FB() privileged, so just return an invalid handle | ||
59 | + * for non-masters. */ | ||
60 | + r->handle = 0; | ||
61 | + ret = 0; | ||
62 | + } | ||
63 | + } else { | ||
64 | ret = -ENODEV; | ||
65 | + } | ||
66 | |||
67 | drm_framebuffer_unreference(fb); | ||
68 | |||
69 | diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c | ||
70 | index e5e32869..c8d16a6 100644 | ||
71 | --- a/drivers/gpu/drm/i915/i915_irq.c | ||
72 | +++ b/drivers/gpu/drm/i915/i915_irq.c | ||
73 | @@ -1009,6 +1009,34 @@ done: | ||
74 | return ret; | ||
75 | } | ||
76 | |||
77 | +static void i915_error_wake_up(struct drm_i915_private *dev_priv, | ||
78 | + bool reset_completed) | ||
79 | +{ | ||
80 | + struct intel_ring_buffer *ring; | ||
81 | + int i; | ||
82 | + | ||
83 | + /* | ||
84 | + * Notify all waiters for GPU completion events that reset state has | ||
85 | + * been changed, and that they need to restart their wait after | ||
86 | + * checking for potential errors (and bail out to drop locks if there is | ||
87 | + * a gpu reset pending so that i915_error_work_func can acquire them). | ||
88 | + */ | ||
89 | + | ||
90 | + /* Wake up __wait_seqno, potentially holding dev->struct_mutex. */ | ||
91 | + for_each_ring(ring, dev_priv, i) | ||
92 | + wake_up_all(&ring->irq_queue); | ||
93 | + | ||
94 | + /* Wake up intel_crtc_wait_for_pending_flips, holding crtc->mutex. */ | ||
95 | + wake_up_all(&dev_priv->pending_flip_queue); | ||
96 | + | ||
97 | + /* | ||
98 | + * Signal tasks blocked in i915_gem_wait_for_error that the pending | ||
99 | + * reset state is cleared. | ||
100 | + */ | ||
101 | + if (reset_completed) | ||
102 | + wake_up_all(&dev_priv->gpu_error.reset_queue); | ||
103 | +} | ||
104 | + | ||
105 | /** | ||
106 | * i915_error_work_func - do process context error handling work | ||
107 | * @work: work struct | ||
108 | @@ -1023,11 +1051,10 @@ static void i915_error_work_func(struct work_struct *work) | ||
109 | drm_i915_private_t *dev_priv = container_of(error, drm_i915_private_t, | ||
110 | gpu_error); | ||
111 | struct drm_device *dev = dev_priv->dev; | ||
112 | - struct intel_ring_buffer *ring; | ||
113 | char *error_event[] = { "ERROR=1", NULL }; | ||
114 | char *reset_event[] = { "RESET=1", NULL }; | ||
115 | char *reset_done_event[] = { "ERROR=0", NULL }; | ||
116 | - int i, ret; | ||
117 | + int ret; | ||
118 | |||
119 | kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, error_event); | ||
120 | |||
121 | @@ -1046,8 +1073,16 @@ static void i915_error_work_func(struct work_struct *work) | ||
122 | kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, | ||
123 | reset_event); | ||
124 | |||
125 | + /* | ||
126 | + * All state reset _must_ be completed before we update the | ||
127 | + * reset counter, for otherwise waiters might miss the reset | ||
128 | + * pending state and not properly drop locks, resulting in | ||
129 | + * deadlocks with the reset work. | ||
130 | + */ | ||
131 | ret = i915_reset(dev); | ||
132 | |||
133 | + intel_display_handle_reset(dev); | ||
134 | + | ||
135 | if (ret == 0) { | ||
136 | /* | ||
137 | * After all the gem state is reset, increment the reset | ||
138 | @@ -1068,12 +1103,11 @@ static void i915_error_work_func(struct work_struct *work) | ||
139 | atomic_set(&error->reset_counter, I915_WEDGED); | ||
140 | } | ||
141 | |||
142 | - for_each_ring(ring, dev_priv, i) | ||
143 | - wake_up_all(&ring->irq_queue); | ||
144 | - | ||
145 | - intel_display_handle_reset(dev); | ||
146 | - | ||
147 | - wake_up_all(&dev_priv->gpu_error.reset_queue); | ||
148 | + /* | ||
149 | + * Note: The wake_up also serves as a memory barrier so that | ||
150 | + * waiters see the update value of the reset counter atomic_t. | ||
151 | + */ | ||
152 | + i915_error_wake_up(dev_priv, true); | ||
153 | } | ||
154 | } | ||
155 | |||
156 | @@ -1709,8 +1743,6 @@ static void i915_report_and_clear_eir(struct drm_device *dev) | ||
157 | void i915_handle_error(struct drm_device *dev, bool wedged) | ||
158 | { | ||
159 | struct drm_i915_private *dev_priv = dev->dev_private; | ||
160 | - struct intel_ring_buffer *ring; | ||
161 | - int i; | ||
162 | |||
163 | i915_capture_error_state(dev); | ||
164 | i915_report_and_clear_eir(dev); | ||
165 | @@ -1720,14 +1752,28 @@ void i915_handle_error(struct drm_device *dev, bool wedged) | ||
166 | &dev_priv->gpu_error.reset_counter); | ||
167 | |||
168 | /* | ||
169 | - * Wakeup waiting processes so that the reset work item | ||
170 | - * doesn't deadlock trying to grab various locks. | ||
171 | + * Wakeup waiting processes so that the reset work function | ||
172 | + * i915_error_work_func doesn't deadlock trying to grab various | ||
173 | + * locks. By bumping the reset counter first, the woken | ||
174 | + * processes will see a reset in progress and back off, | ||
175 | + * releasing their locks and then wait for the reset completion. | ||
176 | + * We must do this for _all_ gpu waiters that might hold locks | ||
177 | + * that the reset work needs to acquire. | ||
178 | + * | ||
179 | + * Note: The wake_up serves as the required memory barrier to | ||
180 | + * ensure that the waiters see the updated value of the reset | ||
181 | + * counter atomic_t. | ||
182 | */ | ||
183 | - for_each_ring(ring, dev_priv, i) | ||
184 | - wake_up_all(&ring->irq_queue); | ||
185 | + i915_error_wake_up(dev_priv, false); | ||
186 | } | ||
187 | |||
188 | - queue_work(dev_priv->wq, &dev_priv->gpu_error.work); | ||
189 | + /* | ||
190 | + * Our reset work can grab modeset locks (since it needs to reset the | ||
191 | + * state of outstanding pagelips). Hence it must not be run on our own | ||
192 | + * dev-priv->wq work queue for otherwise the flush_work in the pageflip | ||
193 | + * code will deadlock. | ||
194 | + */ | ||
195 | + schedule_work(&dev_priv->gpu_error.work); | ||
196 | } | ||
197 | |||
198 | static void __always_unused i915_pageflip_stall_check(struct drm_device *dev, int pipe) | ||
199 | diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c | ||
200 | index f02fd9f..a66b27c 100644 | ||
201 | --- a/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c | ||
202 | +++ b/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c | ||
203 | @@ -49,18 +49,23 @@ int | ||
204 | nv50_dac_sense(struct nv50_disp_priv *priv, int or, u32 loadval) | ||
205 | { | ||
206 | const u32 doff = (or * 0x800); | ||
207 | - int load = -EINVAL; | ||
208 | + | ||
209 | nv_mask(priv, 0x61a004 + doff, 0x807f0000, 0x80150000); | ||
210 | nv_wait(priv, 0x61a004 + doff, 0x80000000, 0x00000000); | ||
211 | + | ||
212 | nv_wr32(priv, 0x61a00c + doff, 0x00100000 | loadval); | ||
213 | mdelay(9); | ||
214 | udelay(500); | ||
215 | - nv_wr32(priv, 0x61a00c + doff, 0x80000000); | ||
216 | - load = (nv_rd32(priv, 0x61a00c + doff) & 0x38000000) >> 27; | ||
217 | - nv_wr32(priv, 0x61a00c + doff, 0x00000000); | ||
218 | + loadval = nv_mask(priv, 0x61a00c + doff, 0xffffffff, 0x00000000); | ||
219 | + | ||
220 | nv_mask(priv, 0x61a004 + doff, 0x807f0000, 0x80550000); | ||
221 | nv_wait(priv, 0x61a004 + doff, 0x80000000, 0x00000000); | ||
222 | - return load; | ||
223 | + | ||
224 | + nv_debug(priv, "DAC%d sense: 0x%08x\n", or, loadval); | ||
225 | + if (!(loadval & 0x80000000)) | ||
226 | + return -ETIMEDOUT; | ||
227 | + | ||
228 | + return (loadval & 0x38000000) >> 27; | ||
229 | } | ||
230 | |||
231 | int | ||
232 | diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c | ||
233 | index 32501f6..1602398 100644 | ||
234 | --- a/drivers/gpu/drm/radeon/atombios_dp.c | ||
235 | +++ b/drivers/gpu/drm/radeon/atombios_dp.c | ||
236 | @@ -50,7 +50,7 @@ static char *pre_emph_names[] = { | ||
237 | * or from atom. Note that atom operates on | ||
238 | * dw units. | ||
239 | */ | ||
240 | -static void radeon_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le) | ||
241 | +void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le) | ||
242 | { | ||
243 | #ifdef __BIG_ENDIAN | ||
244 | u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */ | ||
245 | @@ -100,7 +100,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan, | ||
246 | |||
247 | base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1); | ||
248 | |||
249 | - radeon_copy_swap(base, send, send_bytes, true); | ||
250 | + radeon_atom_copy_swap(base, send, send_bytes, true); | ||
251 | |||
252 | args.v1.lpAuxRequest = cpu_to_le16((u16)(0 + 4)); | ||
253 | args.v1.lpDataOut = cpu_to_le16((u16)(16 + 4)); | ||
254 | @@ -137,7 +137,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan, | ||
255 | recv_bytes = recv_size; | ||
256 | |||
257 | if (recv && recv_size) | ||
258 | - radeon_copy_swap(recv, base + 16, recv_bytes, false); | ||
259 | + radeon_atom_copy_swap(recv, base + 16, recv_bytes, false); | ||
260 | |||
261 | return recv_bytes; | ||
262 | } | ||
263 | diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c | ||
264 | index 4120d35..c272d88 100644 | ||
265 | --- a/drivers/gpu/drm/radeon/atombios_encoders.c | ||
266 | +++ b/drivers/gpu/drm/radeon/atombios_encoders.c | ||
267 | @@ -1636,8 +1636,12 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode) | ||
268 | atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0); | ||
269 | atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0); | ||
270 | atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0); | ||
271 | - /* some early dce3.2 boards have a bug in their transmitter control table */ | ||
272 | - if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730)) | ||
273 | + /* some dce3.x boards have a bug in their transmitter control table. | ||
274 | + * ACTION_ENABLE_OUTPUT can probably be dropped since ACTION_ENABLE | ||
275 | + * does the same thing and more. | ||
276 | + */ | ||
277 | + if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) && | ||
278 | + (rdev->family != CHIP_RS880)) | ||
279 | atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0); | ||
280 | } | ||
281 | if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) { | ||
282 | diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c | ||
283 | index 082338d..2ca389d 100644 | ||
284 | --- a/drivers/gpu/drm/radeon/atombios_i2c.c | ||
285 | +++ b/drivers/gpu/drm/radeon/atombios_i2c.c | ||
286 | @@ -27,6 +27,8 @@ | ||
287 | #include "radeon.h" | ||
288 | #include "atom.h" | ||
289 | |||
290 | +extern void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le); | ||
291 | + | ||
292 | #define TARGET_HW_I2C_CLOCK 50 | ||
293 | |||
294 | /* these are a limitation of ProcessI2cChannelTransaction not the hw */ | ||
295 | @@ -77,7 +79,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan, | ||
296 | } | ||
297 | |||
298 | if (!(flags & HW_I2C_WRITE)) | ||
299 | - memcpy(buf, base, num); | ||
300 | + radeon_atom_copy_swap(buf, base, num, false); | ||
301 | |||
302 | return 0; | ||
303 | } | ||
304 | diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c | ||
305 | index 687b421..2068df1 100644 | ||
306 | --- a/drivers/gpu/drm/radeon/evergreen.c | ||
307 | +++ b/drivers/gpu/drm/radeon/evergreen.c | ||
308 | @@ -1718,7 +1718,8 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev, | ||
309 | struct drm_display_mode *mode, | ||
310 | struct drm_display_mode *other_mode) | ||
311 | { | ||
312 | - u32 tmp; | ||
313 | + u32 tmp, buffer_alloc, i; | ||
314 | + u32 pipe_offset = radeon_crtc->crtc_id * 0x20; | ||
315 | /* | ||
316 | * Line Buffer Setup | ||
317 | * There are 3 line buffers, each one shared by 2 display controllers. | ||
318 | @@ -1741,18 +1742,34 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev, | ||
319 | * non-linked crtcs for maximum line buffer allocation. | ||
320 | */ | ||
321 | if (radeon_crtc->base.enabled && mode) { | ||
322 | - if (other_mode) | ||
323 | + if (other_mode) { | ||
324 | tmp = 0; /* 1/2 */ | ||
325 | - else | ||
326 | + buffer_alloc = 1; | ||
327 | + } else { | ||
328 | tmp = 2; /* whole */ | ||
329 | - } else | ||
330 | + buffer_alloc = 2; | ||
331 | + } | ||
332 | + } else { | ||
333 | tmp = 0; | ||
334 | + buffer_alloc = 0; | ||
335 | + } | ||
336 | |||
337 | /* second controller of the pair uses second half of the lb */ | ||
338 | if (radeon_crtc->crtc_id % 2) | ||
339 | tmp += 4; | ||
340 | WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, tmp); | ||
341 | |||
342 | + if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) { | ||
343 | + WREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset, | ||
344 | + DMIF_BUFFERS_ALLOCATED(buffer_alloc)); | ||
345 | + for (i = 0; i < rdev->usec_timeout; i++) { | ||
346 | + if (RREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset) & | ||
347 | + DMIF_BUFFERS_ALLOCATED_COMPLETED) | ||
348 | + break; | ||
349 | + udelay(1); | ||
350 | + } | ||
351 | + } | ||
352 | + | ||
353 | if (radeon_crtc->base.enabled && mode) { | ||
354 | switch (tmp) { | ||
355 | case 0: | ||
356 | diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h | ||
357 | index 75c0563..9490972 100644 | ||
358 | --- a/drivers/gpu/drm/radeon/evergreend.h | ||
359 | +++ b/drivers/gpu/drm/radeon/evergreend.h | ||
360 | @@ -810,6 +810,10 @@ | ||
361 | # define LATENCY_LOW_WATERMARK(x) ((x) << 0) | ||
362 | # define LATENCY_HIGH_WATERMARK(x) ((x) << 16) | ||
363 | |||
364 | +#define PIPE0_DMIF_BUFFER_CONTROL 0x0ca0 | ||
365 | +# define DMIF_BUFFERS_ALLOCATED(x) ((x) << 0) | ||
366 | +# define DMIF_BUFFERS_ALLOCATED_COMPLETED (1 << 4) | ||
367 | + | ||
368 | #define IH_RB_CNTL 0x3e00 | ||
369 | # define IH_RB_ENABLE (1 << 0) | ||
370 | # define IH_IB_SIZE(x) ((x) << 1) /* log2 */ | ||
371 | diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c | ||
372 | index dea6f63c..239a407 100644 | ||
373 | --- a/drivers/gpu/drm/radeon/radeon_atombios.c | ||
374 | +++ b/drivers/gpu/drm/radeon/radeon_atombios.c | ||
375 | @@ -715,13 +715,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) | ||
376 | (ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT *) | ||
377 | (ctx->bios + data_offset + | ||
378 | le16_to_cpu(router_obj->asObjects[k].usSrcDstTableOffset)); | ||
379 | + u8 *num_dst_objs = (u8 *) | ||
380 | + ((u8 *)router_src_dst_table + 1 + | ||
381 | + (router_src_dst_table->ucNumberOfSrc * 2)); | ||
382 | + u16 *dst_objs = (u16 *)(num_dst_objs + 1); | ||
383 | int enum_id; | ||
384 | |||
385 | router.router_id = router_obj_id; | ||
386 | - for (enum_id = 0; enum_id < router_src_dst_table->ucNumberOfDst; | ||
387 | - enum_id++) { | ||
388 | + for (enum_id = 0; enum_id < (*num_dst_objs); enum_id++) { | ||
389 | if (le16_to_cpu(path->usConnObjectId) == | ||
390 | - le16_to_cpu(router_src_dst_table->usDstObjectID[enum_id])) | ||
391 | + le16_to_cpu(dst_objs[enum_id])) | ||
392 | break; | ||
393 | } | ||
394 | |||
395 | @@ -1651,7 +1654,9 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct | ||
396 | kfree(edid); | ||
397 | } | ||
398 | } | ||
399 | - record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD); | ||
400 | + record += fake_edid_record->ucFakeEDIDLength ? | ||
401 | + fake_edid_record->ucFakeEDIDLength + 2 : | ||
402 | + sizeof(ATOM_FAKE_EDID_PATCH_RECORD); | ||
403 | break; | ||
404 | case LCD_PANEL_RESOLUTION_RECORD_TYPE: | ||
405 | panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record; | ||
406 | diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c | ||
407 | index 2399f25..5a87c9f 100644 | ||
408 | --- a/drivers/gpu/drm/radeon/radeon_connectors.c | ||
409 | +++ b/drivers/gpu/drm/radeon/radeon_connectors.c | ||
410 | @@ -1489,6 +1489,24 @@ static const struct drm_connector_funcs radeon_dp_connector_funcs = { | ||
411 | .force = radeon_dvi_force, | ||
412 | }; | ||
413 | |||
414 | +static const struct drm_connector_funcs radeon_edp_connector_funcs = { | ||
415 | + .dpms = drm_helper_connector_dpms, | ||
416 | + .detect = radeon_dp_detect, | ||
417 | + .fill_modes = drm_helper_probe_single_connector_modes, | ||
418 | + .set_property = radeon_lvds_set_property, | ||
419 | + .destroy = radeon_dp_connector_destroy, | ||
420 | + .force = radeon_dvi_force, | ||
421 | +}; | ||
422 | + | ||
423 | +static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = { | ||
424 | + .dpms = drm_helper_connector_dpms, | ||
425 | + .detect = radeon_dp_detect, | ||
426 | + .fill_modes = drm_helper_probe_single_connector_modes, | ||
427 | + .set_property = radeon_lvds_set_property, | ||
428 | + .destroy = radeon_dp_connector_destroy, | ||
429 | + .force = radeon_dvi_force, | ||
430 | +}; | ||
431 | + | ||
432 | void | ||
433 | radeon_add_atom_connector(struct drm_device *dev, | ||
434 | uint32_t connector_id, | ||
435 | @@ -1580,8 +1598,6 @@ radeon_add_atom_connector(struct drm_device *dev, | ||
436 | goto failed; | ||
437 | radeon_dig_connector->igp_lane_info = igp_lane_info; | ||
438 | radeon_connector->con_priv = radeon_dig_connector; | ||
439 | - drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type); | ||
440 | - drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs); | ||
441 | if (i2c_bus->valid) { | ||
442 | /* add DP i2c bus */ | ||
443 | if (connector_type == DRM_MODE_CONNECTOR_eDP) | ||
444 | @@ -1598,6 +1614,10 @@ radeon_add_atom_connector(struct drm_device *dev, | ||
445 | case DRM_MODE_CONNECTOR_VGA: | ||
446 | case DRM_MODE_CONNECTOR_DVIA: | ||
447 | default: | ||
448 | + drm_connector_init(dev, &radeon_connector->base, | ||
449 | + &radeon_dp_connector_funcs, connector_type); | ||
450 | + drm_connector_helper_add(&radeon_connector->base, | ||
451 | + &radeon_dp_connector_helper_funcs); | ||
452 | connector->interlace_allowed = true; | ||
453 | connector->doublescan_allowed = true; | ||
454 | radeon_connector->dac_load_detect = true; | ||
455 | @@ -1610,6 +1630,10 @@ radeon_add_atom_connector(struct drm_device *dev, | ||
456 | case DRM_MODE_CONNECTOR_HDMIA: | ||
457 | case DRM_MODE_CONNECTOR_HDMIB: | ||
458 | case DRM_MODE_CONNECTOR_DisplayPort: | ||
459 | + drm_connector_init(dev, &radeon_connector->base, | ||
460 | + &radeon_dp_connector_funcs, connector_type); | ||
461 | + drm_connector_helper_add(&radeon_connector->base, | ||
462 | + &radeon_dp_connector_helper_funcs); | ||
463 | drm_object_attach_property(&radeon_connector->base.base, | ||
464 | rdev->mode_info.underscan_property, | ||
465 | UNDERSCAN_OFF); | ||
466 | @@ -1634,6 +1658,10 @@ radeon_add_atom_connector(struct drm_device *dev, | ||
467 | break; | ||
468 | case DRM_MODE_CONNECTOR_LVDS: | ||
469 | case DRM_MODE_CONNECTOR_eDP: | ||
470 | + drm_connector_init(dev, &radeon_connector->base, | ||
471 | + &radeon_lvds_bridge_connector_funcs, connector_type); | ||
472 | + drm_connector_helper_add(&radeon_connector->base, | ||
473 | + &radeon_dp_connector_helper_funcs); | ||
474 | drm_object_attach_property(&radeon_connector->base.base, | ||
475 | dev->mode_config.scaling_mode_property, | ||
476 | DRM_MODE_SCALE_FULLSCREEN); | ||
477 | @@ -1797,7 +1825,7 @@ radeon_add_atom_connector(struct drm_device *dev, | ||
478 | goto failed; | ||
479 | radeon_dig_connector->igp_lane_info = igp_lane_info; | ||
480 | radeon_connector->con_priv = radeon_dig_connector; | ||
481 | - drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type); | ||
482 | + drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type); | ||
483 | drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs); | ||
484 | if (i2c_bus->valid) { | ||
485 | /* add DP i2c bus */ | ||
486 | diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c | ||
487 | index 7e265a5..6337f67 100644 | ||
488 | --- a/drivers/gpu/drm/radeon/radeon_cs.c | ||
489 | +++ b/drivers/gpu/drm/radeon/radeon_cs.c | ||
490 | @@ -80,9 +80,11 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p) | ||
491 | p->relocs[i].lobj.bo = p->relocs[i].robj; | ||
492 | p->relocs[i].lobj.written = !!r->write_domain; | ||
493 | |||
494 | - /* the first reloc of an UVD job is the | ||
495 | - msg and that must be in VRAM */ | ||
496 | - if (p->ring == R600_RING_TYPE_UVD_INDEX && i == 0) { | ||
497 | + /* the first reloc of an UVD job is the msg and that must be in | ||
498 | + VRAM, also but everything into VRAM on AGP cards to avoid | ||
499 | + image corruptions */ | ||
500 | + if (p->ring == R600_RING_TYPE_UVD_INDEX && | ||
501 | + (i == 0 || p->rdev->flags & RADEON_IS_AGP)) { | ||
502 | /* TODO: is this still needed for NI+ ? */ | ||
503 | p->relocs[i].lobj.domain = | ||
504 | RADEON_GEM_DOMAIN_VRAM; | ||
505 | diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c | ||
506 | index 4f2d4f4..7e292d8 100644 | ||
507 | --- a/drivers/gpu/drm/radeon/radeon_kms.c | ||
508 | +++ b/drivers/gpu/drm/radeon/radeon_kms.c | ||
509 | @@ -414,6 +414,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) | ||
510 | value = rdev->config.si.tile_mode_array; | ||
511 | value_size = sizeof(uint32_t)*32; | ||
512 | break; | ||
513 | + case RADEON_INFO_SI_CP_DMA_COMPUTE: | ||
514 | + *value = 1; | ||
515 | + break; | ||
516 | default: | ||
517 | DRM_DEBUG_KMS("Invalid request %d\n", info->request); | ||
518 | return -EINVAL; | ||
519 | diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c | ||
520 | index 233a9b9..b8074a8 100644 | ||
521 | --- a/drivers/gpu/drm/radeon/rs400.c | ||
522 | +++ b/drivers/gpu/drm/radeon/rs400.c | ||
523 | @@ -174,10 +174,13 @@ int rs400_gart_enable(struct radeon_device *rdev) | ||
524 | /* FIXME: according to doc we should set HIDE_MMCFG_BAR=0, | ||
525 | * AGPMODE30=0 & AGP30ENHANCED=0 in NB_CNTL */ | ||
526 | if ((rdev->family == CHIP_RS690) || (rdev->family == CHIP_RS740)) { | ||
527 | - WREG32_MC(RS480_MC_MISC_CNTL, | ||
528 | - (RS480_GART_INDEX_REG_EN | RS690_BLOCK_GFX_D3_EN)); | ||
529 | + tmp = RREG32_MC(RS480_MC_MISC_CNTL); | ||
530 | + tmp |= RS480_GART_INDEX_REG_EN | RS690_BLOCK_GFX_D3_EN; | ||
531 | + WREG32_MC(RS480_MC_MISC_CNTL, tmp); | ||
532 | } else { | ||
533 | - WREG32_MC(RS480_MC_MISC_CNTL, RS480_GART_INDEX_REG_EN); | ||
534 | + tmp = RREG32_MC(RS480_MC_MISC_CNTL); | ||
535 | + tmp |= RS480_GART_INDEX_REG_EN; | ||
536 | + WREG32_MC(RS480_MC_MISC_CNTL, tmp); | ||
537 | } | ||
538 | /* Enable gart */ | ||
539 | WREG32_MC(RS480_AGP_ADDRESS_SPACE_SIZE, (RS480_GART_EN | size_reg)); | ||
540 | diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c | ||
541 | index 1a96a16..f054a3b 100644 | ||
542 | --- a/drivers/gpu/drm/radeon/si.c | ||
543 | +++ b/drivers/gpu/drm/radeon/si.c | ||
544 | @@ -1467,7 +1467,8 @@ static u32 dce6_line_buffer_adjust(struct radeon_device *rdev, | ||
545 | struct drm_display_mode *mode, | ||
546 | struct drm_display_mode *other_mode) | ||
547 | { | ||
548 | - u32 tmp; | ||
549 | + u32 tmp, buffer_alloc, i; | ||
550 | + u32 pipe_offset = radeon_crtc->crtc_id * 0x20; | ||
551 | /* | ||
552 | * Line Buffer Setup | ||
553 | * There are 3 line buffers, each one shared by 2 display controllers. | ||
554 | @@ -1482,16 +1483,30 @@ static u32 dce6_line_buffer_adjust(struct radeon_device *rdev, | ||
555 | * non-linked crtcs for maximum line buffer allocation. | ||
556 | */ | ||
557 | if (radeon_crtc->base.enabled && mode) { | ||
558 | - if (other_mode) | ||
559 | + if (other_mode) { | ||
560 | tmp = 0; /* 1/2 */ | ||
561 | - else | ||
562 | + buffer_alloc = 1; | ||
563 | + } else { | ||
564 | tmp = 2; /* whole */ | ||
565 | - } else | ||
566 | + buffer_alloc = 2; | ||
567 | + } | ||
568 | + } else { | ||
569 | tmp = 0; | ||
570 | + buffer_alloc = 0; | ||
571 | + } | ||
572 | |||
573 | WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, | ||
574 | DC_LB_MEMORY_CONFIG(tmp)); | ||
575 | |||
576 | + WREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset, | ||
577 | + DMIF_BUFFERS_ALLOCATED(buffer_alloc)); | ||
578 | + for (i = 0; i < rdev->usec_timeout; i++) { | ||
579 | + if (RREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset) & | ||
580 | + DMIF_BUFFERS_ALLOCATED_COMPLETED) | ||
581 | + break; | ||
582 | + udelay(1); | ||
583 | + } | ||
584 | + | ||
585 | if (radeon_crtc->base.enabled && mode) { | ||
586 | switch (tmp) { | ||
587 | case 0: | ||
588 | @@ -3796,13 +3811,64 @@ static int si_vm_packet3_ce_check(struct radeon_device *rdev, | ||
589 | return 0; | ||
590 | } | ||
591 | |||
592 | +static int si_vm_packet3_cp_dma_check(u32 *ib, u32 idx) | ||
593 | +{ | ||
594 | + u32 start_reg, reg, i; | ||
595 | + u32 command = ib[idx + 4]; | ||
596 | + u32 info = ib[idx + 1]; | ||
597 | + u32 idx_value = ib[idx]; | ||
598 | + if (command & PACKET3_CP_DMA_CMD_SAS) { | ||
599 | + /* src address space is register */ | ||
600 | + if (((info & 0x60000000) >> 29) == 0) { | ||
601 | + start_reg = idx_value << 2; | ||
602 | + if (command & PACKET3_CP_DMA_CMD_SAIC) { | ||
603 | + reg = start_reg; | ||
604 | + if (!si_vm_reg_valid(reg)) { | ||
605 | + DRM_ERROR("CP DMA Bad SRC register\n"); | ||
606 | + return -EINVAL; | ||
607 | + } | ||
608 | + } else { | ||
609 | + for (i = 0; i < (command & 0x1fffff); i++) { | ||
610 | + reg = start_reg + (4 * i); | ||
611 | + if (!si_vm_reg_valid(reg)) { | ||
612 | + DRM_ERROR("CP DMA Bad SRC register\n"); | ||
613 | + return -EINVAL; | ||
614 | + } | ||
615 | + } | ||
616 | + } | ||
617 | + } | ||
618 | + } | ||
619 | + if (command & PACKET3_CP_DMA_CMD_DAS) { | ||
620 | + /* dst address space is register */ | ||
621 | + if (((info & 0x00300000) >> 20) == 0) { | ||
622 | + start_reg = ib[idx + 2]; | ||
623 | + if (command & PACKET3_CP_DMA_CMD_DAIC) { | ||
624 | + reg = start_reg; | ||
625 | + if (!si_vm_reg_valid(reg)) { | ||
626 | + DRM_ERROR("CP DMA Bad DST register\n"); | ||
627 | + return -EINVAL; | ||
628 | + } | ||
629 | + } else { | ||
630 | + for (i = 0; i < (command & 0x1fffff); i++) { | ||
631 | + reg = start_reg + (4 * i); | ||
632 | + if (!si_vm_reg_valid(reg)) { | ||
633 | + DRM_ERROR("CP DMA Bad DST register\n"); | ||
634 | + return -EINVAL; | ||
635 | + } | ||
636 | + } | ||
637 | + } | ||
638 | + } | ||
639 | + } | ||
640 | + return 0; | ||
641 | +} | ||
642 | + | ||
643 | static int si_vm_packet3_gfx_check(struct radeon_device *rdev, | ||
644 | u32 *ib, struct radeon_cs_packet *pkt) | ||
645 | { | ||
646 | + int r; | ||
647 | u32 idx = pkt->idx + 1; | ||
648 | u32 idx_value = ib[idx]; | ||
649 | u32 start_reg, end_reg, reg, i; | ||
650 | - u32 command, info; | ||
651 | |||
652 | switch (pkt->opcode) { | ||
653 | case PACKET3_NOP: | ||
654 | @@ -3903,50 +3969,9 @@ static int si_vm_packet3_gfx_check(struct radeon_device *rdev, | ||
655 | } | ||
656 | break; | ||
657 | case PACKET3_CP_DMA: | ||
658 | - command = ib[idx + 4]; | ||
659 | - info = ib[idx + 1]; | ||
660 | - if (command & PACKET3_CP_DMA_CMD_SAS) { | ||
661 | - /* src address space is register */ | ||
662 | - if (((info & 0x60000000) >> 29) == 0) { | ||
663 | - start_reg = idx_value << 2; | ||
664 | - if (command & PACKET3_CP_DMA_CMD_SAIC) { | ||
665 | - reg = start_reg; | ||
666 | - if (!si_vm_reg_valid(reg)) { | ||
667 | - DRM_ERROR("CP DMA Bad SRC register\n"); | ||
668 | - return -EINVAL; | ||
669 | - } | ||
670 | - } else { | ||
671 | - for (i = 0; i < (command & 0x1fffff); i++) { | ||
672 | - reg = start_reg + (4 * i); | ||
673 | - if (!si_vm_reg_valid(reg)) { | ||
674 | - DRM_ERROR("CP DMA Bad SRC register\n"); | ||
675 | - return -EINVAL; | ||
676 | - } | ||
677 | - } | ||
678 | - } | ||
679 | - } | ||
680 | - } | ||
681 | - if (command & PACKET3_CP_DMA_CMD_DAS) { | ||
682 | - /* dst address space is register */ | ||
683 | - if (((info & 0x00300000) >> 20) == 0) { | ||
684 | - start_reg = ib[idx + 2]; | ||
685 | - if (command & PACKET3_CP_DMA_CMD_DAIC) { | ||
686 | - reg = start_reg; | ||
687 | - if (!si_vm_reg_valid(reg)) { | ||
688 | - DRM_ERROR("CP DMA Bad DST register\n"); | ||
689 | - return -EINVAL; | ||
690 | - } | ||
691 | - } else { | ||
692 | - for (i = 0; i < (command & 0x1fffff); i++) { | ||
693 | - reg = start_reg + (4 * i); | ||
694 | - if (!si_vm_reg_valid(reg)) { | ||
695 | - DRM_ERROR("CP DMA Bad DST register\n"); | ||
696 | - return -EINVAL; | ||
697 | - } | ||
698 | - } | ||
699 | - } | ||
700 | - } | ||
701 | - } | ||
702 | + r = si_vm_packet3_cp_dma_check(ib, idx); | ||
703 | + if (r) | ||
704 | + return r; | ||
705 | break; | ||
706 | default: | ||
707 | DRM_ERROR("Invalid GFX packet3: 0x%x\n", pkt->opcode); | ||
708 | @@ -3958,6 +3983,7 @@ static int si_vm_packet3_gfx_check(struct radeon_device *rdev, | ||
709 | static int si_vm_packet3_compute_check(struct radeon_device *rdev, | ||
710 | u32 *ib, struct radeon_cs_packet *pkt) | ||
711 | { | ||
712 | + int r; | ||
713 | u32 idx = pkt->idx + 1; | ||
714 | u32 idx_value = ib[idx]; | ||
715 | u32 start_reg, reg, i; | ||
716 | @@ -4030,6 +4056,11 @@ static int si_vm_packet3_compute_check(struct radeon_device *rdev, | ||
717 | return -EINVAL; | ||
718 | } | ||
719 | break; | ||
720 | + case PACKET3_CP_DMA: | ||
721 | + r = si_vm_packet3_cp_dma_check(ib, idx); | ||
722 | + if (r) | ||
723 | + return r; | ||
724 | + break; | ||
725 | default: | ||
726 | DRM_ERROR("Invalid Compute packet3: 0x%x\n", pkt->opcode); | ||
727 | return -EINVAL; | ||
728 | diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h | ||
729 | index 8f2d7d4..8c68e67 100644 | ||
730 | --- a/drivers/gpu/drm/radeon/sid.h | ||
731 | +++ b/drivers/gpu/drm/radeon/sid.h | ||
732 | @@ -97,6 +97,10 @@ | ||
733 | |||
734 | #define DMIF_ADDR_CALC 0xC00 | ||
735 | |||
736 | +#define PIPE0_DMIF_BUFFER_CONTROL 0x0ca0 | ||
737 | +# define DMIF_BUFFERS_ALLOCATED(x) ((x) << 0) | ||
738 | +# define DMIF_BUFFERS_ALLOCATED_COMPLETED (1 << 4) | ||
739 | + | ||
740 | #define SRBM_STATUS 0xE50 | ||
741 | #define GRBM_RQ_PENDING (1 << 5) | ||
742 | #define VMC_BUSY (1 << 8) | ||
743 | diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c | ||
744 | index 5e93a52..210d503 100644 | ||
745 | --- a/drivers/gpu/drm/ttm/ttm_tt.c | ||
746 | +++ b/drivers/gpu/drm/ttm/ttm_tt.c | ||
747 | @@ -170,7 +170,7 @@ void ttm_tt_destroy(struct ttm_tt *ttm) | ||
748 | ttm_tt_unbind(ttm); | ||
749 | } | ||
750 | |||
751 | - if (likely(ttm->pages != NULL)) { | ||
752 | + if (ttm->state == tt_unbound) { | ||
753 | ttm->bdev->driver->ttm_tt_unpopulate(ttm); | ||
754 | } | ||
755 | |||
756 | diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c | ||
757 | index ed626e0..ca959cf 100644 | ||
758 | --- a/drivers/hid/hid-core.c | ||
759 | +++ b/drivers/hid/hid-core.c | ||
760 | @@ -94,7 +94,6 @@ EXPORT_SYMBOL_GPL(hid_register_report); | ||
761 | static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values) | ||
762 | { | ||
763 | struct hid_field *field; | ||
764 | - int i; | ||
765 | |||
766 | if (report->maxfield == HID_MAX_FIELDS) { | ||
767 | hid_err(report->device, "too many fields in report\n"); | ||
768 | @@ -113,9 +112,6 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned | ||
769 | field->value = (s32 *)(field->usage + usages); | ||
770 | field->report = report; | ||
771 | |||
772 | - for (i = 0; i < usages; i++) | ||
773 | - field->usage[i].usage_index = i; | ||
774 | - | ||
775 | return field; | ||
776 | } | ||
777 | |||
778 | @@ -226,9 +222,9 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign | ||
779 | { | ||
780 | struct hid_report *report; | ||
781 | struct hid_field *field; | ||
782 | - int usages; | ||
783 | + unsigned usages; | ||
784 | unsigned offset; | ||
785 | - int i; | ||
786 | + unsigned i; | ||
787 | |||
788 | report = hid_register_report(parser->device, report_type, parser->global.report_id); | ||
789 | if (!report) { | ||
790 | @@ -255,7 +251,8 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign | ||
791 | if (!parser->local.usage_index) /* Ignore padding fields */ | ||
792 | return 0; | ||
793 | |||
794 | - usages = max_t(int, parser->local.usage_index, parser->global.report_count); | ||
795 | + usages = max_t(unsigned, parser->local.usage_index, | ||
796 | + parser->global.report_count); | ||
797 | |||
798 | field = hid_register_field(report, usages, parser->global.report_count); | ||
799 | if (!field) | ||
800 | @@ -266,13 +263,14 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign | ||
801 | field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION); | ||
802 | |||
803 | for (i = 0; i < usages; i++) { | ||
804 | - int j = i; | ||
805 | + unsigned j = i; | ||
806 | /* Duplicate the last usage we parsed if we have excess values */ | ||
807 | if (i >= parser->local.usage_index) | ||
808 | j = parser->local.usage_index - 1; | ||
809 | field->usage[i].hid = parser->local.usage[j]; | ||
810 | field->usage[i].collection_index = | ||
811 | parser->local.collection_index[j]; | ||
812 | + field->usage[i].usage_index = i; | ||
813 | } | ||
814 | |||
815 | field->maxusage = usages; | ||
816 | @@ -759,6 +757,64 @@ int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size) | ||
817 | } | ||
818 | EXPORT_SYMBOL_GPL(hid_parse_report); | ||
819 | |||
820 | +static const char * const hid_report_names[] = { | ||
821 | + "HID_INPUT_REPORT", | ||
822 | + "HID_OUTPUT_REPORT", | ||
823 | + "HID_FEATURE_REPORT", | ||
824 | +}; | ||
825 | +/** | ||
826 | + * hid_validate_values - validate existing device report's value indexes | ||
827 | + * | ||
828 | + * @device: hid device | ||
829 | + * @type: which report type to examine | ||
830 | + * @id: which report ID to examine (0 for first) | ||
831 | + * @field_index: which report field to examine | ||
832 | + * @report_counts: expected number of values | ||
833 | + * | ||
834 | + * Validate the number of values in a given field of a given report, after | ||
835 | + * parsing. | ||
836 | + */ | ||
837 | +struct hid_report *hid_validate_values(struct hid_device *hid, | ||
838 | + unsigned int type, unsigned int id, | ||
839 | + unsigned int field_index, | ||
840 | + unsigned int report_counts) | ||
841 | +{ | ||
842 | + struct hid_report *report; | ||
843 | + | ||
844 | + if (type > HID_FEATURE_REPORT) { | ||
845 | + hid_err(hid, "invalid HID report type %u\n", type); | ||
846 | + return NULL; | ||
847 | + } | ||
848 | + | ||
849 | + if (id >= HID_MAX_IDS) { | ||
850 | + hid_err(hid, "invalid HID report id %u\n", id); | ||
851 | + return NULL; | ||
852 | + } | ||
853 | + | ||
854 | + /* | ||
855 | + * Explicitly not using hid_get_report() here since it depends on | ||
856 | + * ->numbered being checked, which may not always be the case when | ||
857 | + * drivers go to access report values. | ||
858 | + */ | ||
859 | + report = hid->report_enum[type].report_id_hash[id]; | ||
860 | + if (!report) { | ||
861 | + hid_err(hid, "missing %s %u\n", hid_report_names[type], id); | ||
862 | + return NULL; | ||
863 | + } | ||
864 | + if (report->maxfield <= field_index) { | ||
865 | + hid_err(hid, "not enough fields in %s %u\n", | ||
866 | + hid_report_names[type], id); | ||
867 | + return NULL; | ||
868 | + } | ||
869 | + if (report->field[field_index]->report_count < report_counts) { | ||
870 | + hid_err(hid, "not enough values in %s %u field %u\n", | ||
871 | + hid_report_names[type], id, field_index); | ||
872 | + return NULL; | ||
873 | + } | ||
874 | + return report; | ||
875 | +} | ||
876 | +EXPORT_SYMBOL_GPL(hid_validate_values); | ||
877 | + | ||
878 | /** | ||
879 | * hid_open_report - open a driver-specific device report | ||
880 | * | ||
881 | @@ -1237,7 +1293,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size, | ||
882 | goto out; | ||
883 | } | ||
884 | |||
885 | - if (hid->claimed != HID_CLAIMED_HIDRAW) { | ||
886 | + if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) { | ||
887 | for (a = 0; a < report->maxfield; a++) | ||
888 | hid_input_field(hid, report->field[a], cdata, interrupt); | ||
889 | hdrv = hid->driver; | ||
890 | diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c | ||
891 | index ac5e935..012880a 100644 | ||
892 | --- a/drivers/hid/hid-input.c | ||
893 | +++ b/drivers/hid/hid-input.c | ||
894 | @@ -485,6 +485,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel | ||
895 | if (field->flags & HID_MAIN_ITEM_CONSTANT) | ||
896 | goto ignore; | ||
897 | |||
898 | + /* Ignore if report count is out of bounds. */ | ||
899 | + if (field->report_count < 1) | ||
900 | + goto ignore; | ||
901 | + | ||
902 | /* only LED usages are supported in output fields */ | ||
903 | if (field->report_type == HID_OUTPUT_REPORT && | ||
904 | (usage->hid & HID_USAGE_PAGE) != HID_UP_LED) { | ||
905 | @@ -1163,7 +1167,11 @@ static void report_features(struct hid_device *hid) | ||
906 | |||
907 | rep_enum = &hid->report_enum[HID_FEATURE_REPORT]; | ||
908 | list_for_each_entry(rep, &rep_enum->report_list, list) | ||
909 | - for (i = 0; i < rep->maxfield; i++) | ||
910 | + for (i = 0; i < rep->maxfield; i++) { | ||
911 | + /* Ignore if report count is out of bounds. */ | ||
912 | + if (rep->field[i]->report_count < 1) | ||
913 | + continue; | ||
914 | + | ||
915 | for (j = 0; j < rep->field[i]->maxusage; j++) { | ||
916 | /* Verify if Battery Strength feature is available */ | ||
917 | hidinput_setup_battery(hid, HID_FEATURE_REPORT, rep->field[i]); | ||
918 | @@ -1172,6 +1180,7 @@ static void report_features(struct hid_device *hid) | ||
919 | drv->feature_mapping(hid, rep->field[i], | ||
920 | rep->field[i]->usage + j); | ||
921 | } | ||
922 | + } | ||
923 | } | ||
924 | |||
925 | static struct hid_input *hidinput_allocate(struct hid_device *hid) | ||
926 | diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c | ||
927 | index 07837f5..31cf29a 100644 | ||
928 | --- a/drivers/hid/hid-lenovo-tpkbd.c | ||
929 | +++ b/drivers/hid/hid-lenovo-tpkbd.c | ||
930 | @@ -339,7 +339,15 @@ static int tpkbd_probe_tp(struct hid_device *hdev) | ||
931 | struct tpkbd_data_pointer *data_pointer; | ||
932 | size_t name_sz = strlen(dev_name(dev)) + 16; | ||
933 | char *name_mute, *name_micmute; | ||
934 | - int ret; | ||
935 | + int i, ret; | ||
936 | + | ||
937 | + /* Validate required reports. */ | ||
938 | + for (i = 0; i < 4; i++) { | ||
939 | + if (!hid_validate_values(hdev, HID_FEATURE_REPORT, 4, i, 1)) | ||
940 | + return -ENODEV; | ||
941 | + } | ||
942 | + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 3, 0, 2)) | ||
943 | + return -ENODEV; | ||
944 | |||
945 | if (sysfs_create_group(&hdev->dev.kobj, | ||
946 | &tpkbd_attr_group_pointer)) { | ||
947 | @@ -406,22 +414,27 @@ static int tpkbd_probe(struct hid_device *hdev, | ||
948 | ret = hid_parse(hdev); | ||
949 | if (ret) { | ||
950 | hid_err(hdev, "hid_parse failed\n"); | ||
951 | - goto err_free; | ||
952 | + goto err; | ||
953 | } | ||
954 | |||
955 | ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); | ||
956 | if (ret) { | ||
957 | hid_err(hdev, "hid_hw_start failed\n"); | ||
958 | - goto err_free; | ||
959 | + goto err; | ||
960 | } | ||
961 | |||
962 | uhdev = (struct usbhid_device *) hdev->driver_data; | ||
963 | |||
964 | - if (uhdev->ifnum == 1) | ||
965 | - return tpkbd_probe_tp(hdev); | ||
966 | + if (uhdev->ifnum == 1) { | ||
967 | + ret = tpkbd_probe_tp(hdev); | ||
968 | + if (ret) | ||
969 | + goto err_hid; | ||
970 | + } | ||
971 | |||
972 | return 0; | ||
973 | -err_free: | ||
974 | +err_hid: | ||
975 | + hid_hw_stop(hdev); | ||
976 | +err: | ||
977 | return ret; | ||
978 | } | ||
979 | |||
980 | diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c | ||
981 | index b3cd150..1a42eaa 100644 | ||
982 | --- a/drivers/hid/hid-lg2ff.c | ||
983 | +++ b/drivers/hid/hid-lg2ff.c | ||
984 | @@ -64,26 +64,13 @@ int lg2ff_init(struct hid_device *hid) | ||
985 | struct hid_report *report; | ||
986 | struct hid_input *hidinput = list_entry(hid->inputs.next, | ||
987 | struct hid_input, list); | ||
988 | - struct list_head *report_list = | ||
989 | - &hid->report_enum[HID_OUTPUT_REPORT].report_list; | ||
990 | struct input_dev *dev = hidinput->input; | ||
991 | int error; | ||
992 | |||
993 | - if (list_empty(report_list)) { | ||
994 | - hid_err(hid, "no output report found\n"); | ||
995 | + /* Check that the report looks ok */ | ||
996 | + report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7); | ||
997 | + if (!report) | ||
998 | return -ENODEV; | ||
999 | - } | ||
1000 | - | ||
1001 | - report = list_entry(report_list->next, struct hid_report, list); | ||
1002 | - | ||
1003 | - if (report->maxfield < 1) { | ||
1004 | - hid_err(hid, "output report is empty\n"); | ||
1005 | - return -ENODEV; | ||
1006 | - } | ||
1007 | - if (report->field[0]->report_count < 7) { | ||
1008 | - hid_err(hid, "not enough values in the field\n"); | ||
1009 | - return -ENODEV; | ||
1010 | - } | ||
1011 | |||
1012 | lg2ff = kmalloc(sizeof(struct lg2ff_device), GFP_KERNEL); | ||
1013 | if (!lg2ff) | ||
1014 | diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c | ||
1015 | index e52f181..8c2da18 100644 | ||
1016 | --- a/drivers/hid/hid-lg3ff.c | ||
1017 | +++ b/drivers/hid/hid-lg3ff.c | ||
1018 | @@ -66,10 +66,11 @@ static int hid_lg3ff_play(struct input_dev *dev, void *data, | ||
1019 | int x, y; | ||
1020 | |||
1021 | /* | ||
1022 | - * Maxusage should always be 63 (maximum fields) | ||
1023 | - * likely a better way to ensure this data is clean | ||
1024 | + * Available values in the field should always be 63, but we only use up to | ||
1025 | + * 35. Instead, clear the entire area, however big it is. | ||
1026 | */ | ||
1027 | - memset(report->field[0]->value, 0, sizeof(__s32)*report->field[0]->maxusage); | ||
1028 | + memset(report->field[0]->value, 0, | ||
1029 | + sizeof(__s32) * report->field[0]->report_count); | ||
1030 | |||
1031 | switch (effect->type) { | ||
1032 | case FF_CONSTANT: | ||
1033 | @@ -129,32 +130,14 @@ static const signed short ff3_joystick_ac[] = { | ||
1034 | int lg3ff_init(struct hid_device *hid) | ||
1035 | { | ||
1036 | struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); | ||
1037 | - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; | ||
1038 | struct input_dev *dev = hidinput->input; | ||
1039 | - struct hid_report *report; | ||
1040 | - struct hid_field *field; | ||
1041 | const signed short *ff_bits = ff3_joystick_ac; | ||
1042 | int error; | ||
1043 | int i; | ||
1044 | |||
1045 | - /* Find the report to use */ | ||
1046 | - if (list_empty(report_list)) { | ||
1047 | - hid_err(hid, "No output report found\n"); | ||
1048 | - return -1; | ||
1049 | - } | ||
1050 | - | ||
1051 | /* Check that the report looks ok */ | ||
1052 | - report = list_entry(report_list->next, struct hid_report, list); | ||
1053 | - if (!report) { | ||
1054 | - hid_err(hid, "NULL output report\n"); | ||
1055 | - return -1; | ||
1056 | - } | ||
1057 | - | ||
1058 | - field = report->field[0]; | ||
1059 | - if (!field) { | ||
1060 | - hid_err(hid, "NULL field\n"); | ||
1061 | - return -1; | ||
1062 | - } | ||
1063 | + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35)) | ||
1064 | + return -ENODEV; | ||
1065 | |||
1066 | /* Assume single fixed device G940 */ | ||
1067 | for (i = 0; ff_bits[i] >= 0; i++) | ||
1068 | diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c | ||
1069 | index 0ddae2a..8782fe1 100644 | ||
1070 | --- a/drivers/hid/hid-lg4ff.c | ||
1071 | +++ b/drivers/hid/hid-lg4ff.c | ||
1072 | @@ -484,34 +484,16 @@ static enum led_brightness lg4ff_led_get_brightness(struct led_classdev *led_cde | ||
1073 | int lg4ff_init(struct hid_device *hid) | ||
1074 | { | ||
1075 | struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); | ||
1076 | - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; | ||
1077 | struct input_dev *dev = hidinput->input; | ||
1078 | - struct hid_report *report; | ||
1079 | - struct hid_field *field; | ||
1080 | struct lg4ff_device_entry *entry; | ||
1081 | struct lg_drv_data *drv_data; | ||
1082 | struct usb_device_descriptor *udesc; | ||
1083 | int error, i, j; | ||
1084 | __u16 bcdDevice, rev_maj, rev_min; | ||
1085 | |||
1086 | - /* Find the report to use */ | ||
1087 | - if (list_empty(report_list)) { | ||
1088 | - hid_err(hid, "No output report found\n"); | ||
1089 | - return -1; | ||
1090 | - } | ||
1091 | - | ||
1092 | /* Check that the report looks ok */ | ||
1093 | - report = list_entry(report_list->next, struct hid_report, list); | ||
1094 | - if (!report) { | ||
1095 | - hid_err(hid, "NULL output report\n"); | ||
1096 | + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) | ||
1097 | return -1; | ||
1098 | - } | ||
1099 | - | ||
1100 | - field = report->field[0]; | ||
1101 | - if (!field) { | ||
1102 | - hid_err(hid, "NULL field\n"); | ||
1103 | - return -1; | ||
1104 | - } | ||
1105 | |||
1106 | /* Check what wheel has been connected */ | ||
1107 | for (i = 0; i < ARRAY_SIZE(lg4ff_devices); i++) { | ||
1108 | diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c | ||
1109 | index d7ea8c8..e1394af 100644 | ||
1110 | --- a/drivers/hid/hid-lgff.c | ||
1111 | +++ b/drivers/hid/hid-lgff.c | ||
1112 | @@ -128,27 +128,14 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude) | ||
1113 | int lgff_init(struct hid_device* hid) | ||
1114 | { | ||
1115 | struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); | ||
1116 | - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; | ||
1117 | struct input_dev *dev = hidinput->input; | ||
1118 | - struct hid_report *report; | ||
1119 | - struct hid_field *field; | ||
1120 | const signed short *ff_bits = ff_joystick; | ||
1121 | int error; | ||
1122 | int i; | ||
1123 | |||
1124 | - /* Find the report to use */ | ||
1125 | - if (list_empty(report_list)) { | ||
1126 | - hid_err(hid, "No output report found\n"); | ||
1127 | - return -1; | ||
1128 | - } | ||
1129 | - | ||
1130 | /* Check that the report looks ok */ | ||
1131 | - report = list_entry(report_list->next, struct hid_report, list); | ||
1132 | - field = report->field[0]; | ||
1133 | - if (!field) { | ||
1134 | - hid_err(hid, "NULL field\n"); | ||
1135 | - return -1; | ||
1136 | - } | ||
1137 | + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) | ||
1138 | + return -ENODEV; | ||
1139 | |||
1140 | for (i = 0; i < ARRAY_SIZE(devices); i++) { | ||
1141 | if (dev->id.vendor == devices[i].idVendor && | ||
1142 | diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c | ||
1143 | index 5207591a..0522b80 100644 | ||
1144 | --- a/drivers/hid/hid-logitech-dj.c | ||
1145 | +++ b/drivers/hid/hid-logitech-dj.c | ||
1146 | @@ -421,7 +421,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev, | ||
1147 | struct hid_report *report; | ||
1148 | struct hid_report_enum *output_report_enum; | ||
1149 | u8 *data = (u8 *)(&dj_report->device_index); | ||
1150 | - int i; | ||
1151 | + unsigned int i; | ||
1152 | |||
1153 | output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT]; | ||
1154 | report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT]; | ||
1155 | @@ -431,7 +431,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev, | ||
1156 | return -ENODEV; | ||
1157 | } | ||
1158 | |||
1159 | - for (i = 0; i < report->field[0]->report_count; i++) | ||
1160 | + for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++) | ||
1161 | report->field[0]->value[i] = data[i]; | ||
1162 | |||
1163 | hid_hw_request(hdev, report, HID_REQ_SET_REPORT); | ||
1164 | @@ -738,6 +738,12 @@ static int logi_dj_probe(struct hid_device *hdev, | ||
1165 | goto hid_parse_fail; | ||
1166 | } | ||
1167 | |||
1168 | + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT, | ||
1169 | + 0, DJREPORT_SHORT_LENGTH - 1)) { | ||
1170 | + retval = -ENODEV; | ||
1171 | + goto hid_parse_fail; | ||
1172 | + } | ||
1173 | + | ||
1174 | /* Starts the usb device and connects to upper interfaces hiddev and | ||
1175 | * hidraw */ | ||
1176 | retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT); | ||
1177 | diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c | ||
1178 | index d39a5ce..b6701ce 100644 | ||
1179 | --- a/drivers/hid/hid-multitouch.c | ||
1180 | +++ b/drivers/hid/hid-multitouch.c | ||
1181 | @@ -101,9 +101,9 @@ struct mt_device { | ||
1182 | unsigned last_slot_field; /* the last field of a slot */ | ||
1183 | unsigned mt_report_id; /* the report ID of the multitouch device */ | ||
1184 | unsigned pen_report_id; /* the report ID of the pen device */ | ||
1185 | - __s8 inputmode; /* InputMode HID feature, -1 if non-existent */ | ||
1186 | - __s8 inputmode_index; /* InputMode HID feature index in the report */ | ||
1187 | - __s8 maxcontact_report_id; /* Maximum Contact Number HID feature, | ||
1188 | + __s16 inputmode; /* InputMode HID feature, -1 if non-existent */ | ||
1189 | + __s16 inputmode_index; /* InputMode HID feature index in the report */ | ||
1190 | + __s16 maxcontact_report_id; /* Maximum Contact Number HID feature, | ||
1191 | -1 if non-existent */ | ||
1192 | __u8 num_received; /* how many contacts we received */ | ||
1193 | __u8 num_expected; /* expected last contact index */ | ||
1194 | @@ -317,20 +317,18 @@ static void mt_feature_mapping(struct hid_device *hdev, | ||
1195 | struct hid_field *field, struct hid_usage *usage) | ||
1196 | { | ||
1197 | struct mt_device *td = hid_get_drvdata(hdev); | ||
1198 | - int i; | ||
1199 | |||
1200 | switch (usage->hid) { | ||
1201 | case HID_DG_INPUTMODE: | ||
1202 | - td->inputmode = field->report->id; | ||
1203 | - td->inputmode_index = 0; /* has to be updated below */ | ||
1204 | - | ||
1205 | - for (i=0; i < field->maxusage; i++) { | ||
1206 | - if (field->usage[i].hid == usage->hid) { | ||
1207 | - td->inputmode_index = i; | ||
1208 | - break; | ||
1209 | - } | ||
1210 | + /* Ignore if value index is out of bounds. */ | ||
1211 | + if (usage->usage_index >= field->report_count) { | ||
1212 | + dev_err(&hdev->dev, "HID_DG_INPUTMODE out of range\n"); | ||
1213 | + break; | ||
1214 | } | ||
1215 | |||
1216 | + td->inputmode = field->report->id; | ||
1217 | + td->inputmode_index = usage->usage_index; | ||
1218 | + | ||
1219 | break; | ||
1220 | case HID_DG_CONTACTMAX: | ||
1221 | td->maxcontact_report_id = field->report->id; | ||
1222 | @@ -536,6 +534,10 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, | ||
1223 | mt_store_field(usage, td, hi); | ||
1224 | return 1; | ||
1225 | case HID_DG_CONTACTCOUNT: | ||
1226 | + /* Ignore if indexes are out of bounds. */ | ||
1227 | + if (field->index >= field->report->maxfield || | ||
1228 | + usage->usage_index >= field->report_count) | ||
1229 | + return 1; | ||
1230 | td->cc_index = field->index; | ||
1231 | td->cc_value_index = usage->usage_index; | ||
1232 | return 1; | ||
1233 | diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c | ||
1234 | index d164911..29f328f 100644 | ||
1235 | --- a/drivers/hid/hid-steelseries.c | ||
1236 | +++ b/drivers/hid/hid-steelseries.c | ||
1237 | @@ -249,6 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev, | ||
1238 | goto err_free; | ||
1239 | } | ||
1240 | |||
1241 | + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) { | ||
1242 | + ret = -ENODEV; | ||
1243 | + goto err_free; | ||
1244 | + } | ||
1245 | + | ||
1246 | ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); | ||
1247 | if (ret) { | ||
1248 | hid_err(hdev, "hw start failed\n"); | ||
1249 | diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c | ||
1250 | index 6ec28a3..a29756c 100644 | ||
1251 | --- a/drivers/hid/hid-zpff.c | ||
1252 | +++ b/drivers/hid/hid-zpff.c | ||
1253 | @@ -68,21 +68,13 @@ static int zpff_init(struct hid_device *hid) | ||
1254 | struct hid_report *report; | ||
1255 | struct hid_input *hidinput = list_entry(hid->inputs.next, | ||
1256 | struct hid_input, list); | ||
1257 | - struct list_head *report_list = | ||
1258 | - &hid->report_enum[HID_OUTPUT_REPORT].report_list; | ||
1259 | struct input_dev *dev = hidinput->input; | ||
1260 | - int error; | ||
1261 | + int i, error; | ||
1262 | |||
1263 | - if (list_empty(report_list)) { | ||
1264 | - hid_err(hid, "no output report found\n"); | ||
1265 | - return -ENODEV; | ||
1266 | - } | ||
1267 | - | ||
1268 | - report = list_entry(report_list->next, struct hid_report, list); | ||
1269 | - | ||
1270 | - if (report->maxfield < 4) { | ||
1271 | - hid_err(hid, "not enough fields in report\n"); | ||
1272 | - return -ENODEV; | ||
1273 | + for (i = 0; i < 4; i++) { | ||
1274 | + report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1); | ||
1275 | + if (!report) | ||
1276 | + return -ENODEV; | ||
1277 | } | ||
1278 | |||
1279 | zpff = kzalloc(sizeof(struct zpff_device), GFP_KERNEL); | ||
1280 | diff --git a/drivers/media/pci/Kconfig b/drivers/media/pci/Kconfig | ||
1281 | index d4e2ed3..53196f1 100644 | ||
1282 | --- a/drivers/media/pci/Kconfig | ||
1283 | +++ b/drivers/media/pci/Kconfig | ||
1284 | @@ -1,6 +1,7 @@ | ||
1285 | +if PCI && MEDIA_SUPPORT | ||
1286 | + | ||
1287 | menuconfig MEDIA_PCI_SUPPORT | ||
1288 | bool "Media PCI Adapters" | ||
1289 | - depends on PCI && MEDIA_SUPPORT | ||
1290 | help | ||
1291 | Enable media drivers for PCI/PCIe bus. | ||
1292 | If you have such devices, say Y. | ||
1293 | @@ -45,3 +46,4 @@ source "drivers/media/pci/ddbridge/Kconfig" | ||
1294 | endif | ||
1295 | |||
1296 | endif #MEDIA_PCI_SUPPORT | ||
1297 | +endif #PCI | ||
1298 | diff --git a/drivers/media/usb/Kconfig b/drivers/media/usb/Kconfig | ||
1299 | index 0a7d520..7cac453 100644 | ||
1300 | --- a/drivers/media/usb/Kconfig | ||
1301 | +++ b/drivers/media/usb/Kconfig | ||
1302 | @@ -1,6 +1,7 @@ | ||
1303 | +if USB && MEDIA_SUPPORT | ||
1304 | + | ||
1305 | menuconfig MEDIA_USB_SUPPORT | ||
1306 | bool "Media USB Adapters" | ||
1307 | - depends on USB && MEDIA_SUPPORT | ||
1308 | help | ||
1309 | Enable media drivers for USB bus. | ||
1310 | If you have such devices, say Y. | ||
1311 | @@ -52,3 +53,4 @@ source "drivers/media/usb/em28xx/Kconfig" | ||
1312 | endif | ||
1313 | |||
1314 | endif #MEDIA_USB_SUPPORT | ||
1315 | +endif #USB | ||
1316 | diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c | ||
1317 | index eec0af4..1c6bc96 100644 | ||
1318 | --- a/drivers/net/ethernet/broadcom/bgmac.c | ||
1319 | +++ b/drivers/net/ethernet/broadcom/bgmac.c | ||
1320 | @@ -908,7 +908,7 @@ static void bgmac_chip_reset(struct bgmac *bgmac) | ||
1321 | struct bcma_drv_cc *cc = &bgmac->core->bus->drv_cc; | ||
1322 | u8 et_swtype = 0; | ||
1323 | u8 sw_type = BGMAC_CHIPCTL_1_SW_TYPE_EPHY | | ||
1324 | - BGMAC_CHIPCTL_1_IF_TYPE_RMII; | ||
1325 | + BGMAC_CHIPCTL_1_IF_TYPE_MII; | ||
1326 | char buf[2]; | ||
1327 | |||
1328 | if (bcm47xx_nvram_getenv("et_swtype", buf, 1) > 0) { | ||
1329 | diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h | ||
1330 | index 98d4b5f..12a35cf 100644 | ||
1331 | --- a/drivers/net/ethernet/broadcom/bgmac.h | ||
1332 | +++ b/drivers/net/ethernet/broadcom/bgmac.h | ||
1333 | @@ -333,7 +333,7 @@ | ||
1334 | |||
1335 | #define BGMAC_CHIPCTL_1_IF_TYPE_MASK 0x00000030 | ||
1336 | #define BGMAC_CHIPCTL_1_IF_TYPE_RMII 0x00000000 | ||
1337 | -#define BGMAC_CHIPCTL_1_IF_TYPE_MI 0x00000010 | ||
1338 | +#define BGMAC_CHIPCTL_1_IF_TYPE_MII 0x00000010 | ||
1339 | #define BGMAC_CHIPCTL_1_IF_TYPE_RGMII 0x00000020 | ||
1340 | #define BGMAC_CHIPCTL_1_SW_TYPE_MASK 0x000000C0 | ||
1341 | #define BGMAC_CHIPCTL_1_SW_TYPE_EPHY 0x00000000 | ||
1342 | diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c | ||
1343 | index 04ee044..b1897c7 100644 | ||
1344 | --- a/drivers/net/usb/cdc_ether.c | ||
1345 | +++ b/drivers/net/usb/cdc_ether.c | ||
1346 | @@ -709,6 +709,11 @@ static const struct usb_device_id products [] = { | ||
1347 | .bInterfaceProtocol = USB_CDC_PROTO_NONE, | ||
1348 | .driver_info = (unsigned long)&wwan_info, | ||
1349 | }, { | ||
1350 | + /* Telit modules */ | ||
1351 | + USB_VENDOR_AND_INTERFACE_INFO(0x1bc7, USB_CLASS_COMM, | ||
1352 | + USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), | ||
1353 | + .driver_info = (kernel_ulong_t) &wwan_info, | ||
1354 | +}, { | ||
1355 | USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, | ||
1356 | USB_CDC_PROTO_NONE), | ||
1357 | .driver_info = (unsigned long) &cdc_info, | ||
1358 | diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c | ||
1359 | index 7e66a90..f281971 100644 | ||
1360 | --- a/drivers/net/wireless/rt2x00/rt2800lib.c | ||
1361 | +++ b/drivers/net/wireless/rt2x00/rt2800lib.c | ||
1362 | @@ -2767,6 +2767,13 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev) | ||
1363 | int i; | ||
1364 | |||
1365 | /* | ||
1366 | + * First check if temperature compensation is supported. | ||
1367 | + */ | ||
1368 | + rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom); | ||
1369 | + if (!rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_EXTERNAL_TX_ALC)) | ||
1370 | + return 0; | ||
1371 | + | ||
1372 | + /* | ||
1373 | * Read TSSI boundaries for temperature compensation from | ||
1374 | * the EEPROM. | ||
1375 | * | ||
1376 | @@ -4041,10 +4048,6 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev) | ||
1377 | u8 reg_id; | ||
1378 | u8 value; | ||
1379 | |||
1380 | - if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) || | ||
1381 | - rt2800_wait_bbp_ready(rt2x00dev))) | ||
1382 | - return -EACCES; | ||
1383 | - | ||
1384 | if (rt2x00_rt(rt2x00dev, RT5592)) { | ||
1385 | rt2800_init_bbp_5592(rt2x00dev); | ||
1386 | return 0; | ||
1387 | @@ -5185,20 +5188,23 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev) | ||
1388 | rt2800_init_registers(rt2x00dev))) | ||
1389 | return -EIO; | ||
1390 | |||
1391 | + if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev))) | ||
1392 | + return -EIO; | ||
1393 | + | ||
1394 | /* | ||
1395 | * Send signal to firmware during boot time. | ||
1396 | */ | ||
1397 | rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0); | ||
1398 | rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0); | ||
1399 | - if (rt2x00_is_usb(rt2x00dev)) { | ||
1400 | + if (rt2x00_is_usb(rt2x00dev)) | ||
1401 | rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0); | ||
1402 | - rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0); | ||
1403 | - } | ||
1404 | + rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0); | ||
1405 | msleep(1); | ||
1406 | |||
1407 | - if (unlikely(rt2800_init_bbp(rt2x00dev))) | ||
1408 | + if (unlikely(rt2800_wait_bbp_ready(rt2x00dev))) | ||
1409 | return -EIO; | ||
1410 | |||
1411 | + rt2800_init_bbp(rt2x00dev); | ||
1412 | rt2800_init_rfcsr(rt2x00dev); | ||
1413 | |||
1414 | if (rt2x00_is_usb(rt2x00dev) && | ||
1415 | diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c | ||
1416 | index 336b3f9..0eab3a3 100644 | ||
1417 | --- a/drivers/pci/pci-acpi.c | ||
1418 | +++ b/drivers/pci/pci-acpi.c | ||
1419 | @@ -47,6 +47,9 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context) | ||
1420 | if (event != ACPI_NOTIFY_DEVICE_WAKE || !pci_dev) | ||
1421 | return; | ||
1422 | |||
1423 | + if (pci_dev->pme_poll) | ||
1424 | + pci_dev->pme_poll = false; | ||
1425 | + | ||
1426 | if (pci_dev->current_state == PCI_D3cold) { | ||
1427 | pci_wakeup_event(pci_dev); | ||
1428 | pm_runtime_resume(&pci_dev->dev); | ||
1429 | @@ -57,9 +60,6 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context) | ||
1430 | if (pci_dev->pme_support) | ||
1431 | pci_check_pme_status(pci_dev); | ||
1432 | |||
1433 | - if (pci_dev->pme_poll) | ||
1434 | - pci_dev->pme_poll = false; | ||
1435 | - | ||
1436 | pci_wakeup_event(pci_dev); | ||
1437 | pm_runtime_resume(&pci_dev->dev); | ||
1438 | |||
1439 | diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c | ||
1440 | index c588e8e..ac0e79e 100644 | ||
1441 | --- a/drivers/usb/gadget/dummy_hcd.c | ||
1442 | +++ b/drivers/usb/gadget/dummy_hcd.c | ||
1443 | @@ -923,8 +923,9 @@ static int dummy_udc_stop(struct usb_gadget *g, | ||
1444 | struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); | ||
1445 | struct dummy *dum = dum_hcd->dum; | ||
1446 | |||
1447 | - dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n", | ||
1448 | - driver->driver.name); | ||
1449 | + if (driver) | ||
1450 | + dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n", | ||
1451 | + driver->driver.name); | ||
1452 | |||
1453 | dum->driver = NULL; | ||
1454 | |||
1455 | @@ -1000,8 +1001,8 @@ static int dummy_udc_remove(struct platform_device *pdev) | ||
1456 | { | ||
1457 | struct dummy *dum = platform_get_drvdata(pdev); | ||
1458 | |||
1459 | - usb_del_gadget_udc(&dum->gadget); | ||
1460 | device_remove_file(&dum->gadget.dev, &dev_attr_function); | ||
1461 | + usb_del_gadget_udc(&dum->gadget); | ||
1462 | return 0; | ||
1463 | } | ||
1464 | |||
1465 | diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c | ||
1466 | index 8fb4291..45e944f 100644 | ||
1467 | --- a/fs/bio-integrity.c | ||
1468 | +++ b/fs/bio-integrity.c | ||
1469 | @@ -734,7 +734,7 @@ void bioset_integrity_free(struct bio_set *bs) | ||
1470 | mempool_destroy(bs->bio_integrity_pool); | ||
1471 | |||
1472 | if (bs->bvec_integrity_pool) | ||
1473 | - mempool_destroy(bs->bio_integrity_pool); | ||
1474 | + mempool_destroy(bs->bvec_integrity_pool); | ||
1475 | } | ||
1476 | EXPORT_SYMBOL(bioset_integrity_free); | ||
1477 | |||
1478 | diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c | ||
1479 | index 5699b50..0c2425b 100644 | ||
1480 | --- a/fs/cifs/dir.c | ||
1481 | +++ b/fs/cifs/dir.c | ||
1482 | @@ -491,6 +491,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, | ||
1483 | if (server->ops->close) | ||
1484 | server->ops->close(xid, tcon, &fid); | ||
1485 | cifs_del_pending_open(&open); | ||
1486 | + fput(file); | ||
1487 | rc = -ENOMEM; | ||
1488 | } | ||
1489 | |||
1490 | diff --git a/fs/udf/super.c b/fs/udf/super.c | ||
1491 | index 9ac4057..839a2ba 100644 | ||
1492 | --- a/fs/udf/super.c | ||
1493 | +++ b/fs/udf/super.c | ||
1494 | @@ -630,6 +630,12 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options) | ||
1495 | struct udf_sb_info *sbi = UDF_SB(sb); | ||
1496 | int error = 0; | ||
1497 | |||
1498 | + if (sbi->s_lvid_bh) { | ||
1499 | + int write_rev = le16_to_cpu(udf_sb_lvidiu(sbi)->minUDFWriteRev); | ||
1500 | + if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & MS_RDONLY)) | ||
1501 | + return -EACCES; | ||
1502 | + } | ||
1503 | + | ||
1504 | uopt.flags = sbi->s_flags; | ||
1505 | uopt.uid = sbi->s_uid; | ||
1506 | uopt.gid = sbi->s_gid; | ||
1507 | @@ -649,12 +655,6 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options) | ||
1508 | sbi->s_dmode = uopt.dmode; | ||
1509 | write_unlock(&sbi->s_cred_lock); | ||
1510 | |||
1511 | - if (sbi->s_lvid_bh) { | ||
1512 | - int write_rev = le16_to_cpu(udf_sb_lvidiu(sbi)->minUDFWriteRev); | ||
1513 | - if (write_rev > UDF_MAX_WRITE_VERSION) | ||
1514 | - *flags |= MS_RDONLY; | ||
1515 | - } | ||
1516 | - | ||
1517 | if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) | ||
1518 | goto out_unlock; | ||
1519 | |||
1520 | @@ -843,27 +843,38 @@ static int udf_find_fileset(struct super_block *sb, | ||
1521 | return 1; | ||
1522 | } | ||
1523 | |||
1524 | +/* | ||
1525 | + * Load primary Volume Descriptor Sequence | ||
1526 | + * | ||
1527 | + * Return <0 on error, 0 on success. -EAGAIN is special meaning next sequence | ||
1528 | + * should be tried. | ||
1529 | + */ | ||
1530 | static int udf_load_pvoldesc(struct super_block *sb, sector_t block) | ||
1531 | { | ||
1532 | struct primaryVolDesc *pvoldesc; | ||
1533 | struct ustr *instr, *outstr; | ||
1534 | struct buffer_head *bh; | ||
1535 | uint16_t ident; | ||
1536 | - int ret = 1; | ||
1537 | + int ret = -ENOMEM; | ||
1538 | |||
1539 | instr = kmalloc(sizeof(struct ustr), GFP_NOFS); | ||
1540 | if (!instr) | ||
1541 | - return 1; | ||
1542 | + return -ENOMEM; | ||
1543 | |||
1544 | outstr = kmalloc(sizeof(struct ustr), GFP_NOFS); | ||
1545 | if (!outstr) | ||
1546 | goto out1; | ||
1547 | |||
1548 | bh = udf_read_tagged(sb, block, block, &ident); | ||
1549 | - if (!bh) | ||
1550 | + if (!bh) { | ||
1551 | + ret = -EAGAIN; | ||
1552 | goto out2; | ||
1553 | + } | ||
1554 | |||
1555 | - BUG_ON(ident != TAG_IDENT_PVD); | ||
1556 | + if (ident != TAG_IDENT_PVD) { | ||
1557 | + ret = -EIO; | ||
1558 | + goto out_bh; | ||
1559 | + } | ||
1560 | |||
1561 | pvoldesc = (struct primaryVolDesc *)bh->b_data; | ||
1562 | |||
1563 | @@ -889,8 +900,9 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block) | ||
1564 | if (udf_CS0toUTF8(outstr, instr)) | ||
1565 | udf_debug("volSetIdent[] = '%s'\n", outstr->u_name); | ||
1566 | |||
1567 | - brelse(bh); | ||
1568 | ret = 0; | ||
1569 | +out_bh: | ||
1570 | + brelse(bh); | ||
1571 | out2: | ||
1572 | kfree(outstr); | ||
1573 | out1: | ||
1574 | @@ -947,7 +959,7 @@ static int udf_load_metadata_files(struct super_block *sb, int partition) | ||
1575 | |||
1576 | if (mdata->s_mirror_fe == NULL) { | ||
1577 | udf_err(sb, "Both metadata and mirror metadata inode efe can not found\n"); | ||
1578 | - goto error_exit; | ||
1579 | + return -EIO; | ||
1580 | } | ||
1581 | } | ||
1582 | |||
1583 | @@ -964,23 +976,18 @@ static int udf_load_metadata_files(struct super_block *sb, int partition) | ||
1584 | addr.logicalBlockNum, addr.partitionReferenceNum); | ||
1585 | |||
1586 | mdata->s_bitmap_fe = udf_iget(sb, &addr); | ||
1587 | - | ||
1588 | if (mdata->s_bitmap_fe == NULL) { | ||
1589 | if (sb->s_flags & MS_RDONLY) | ||
1590 | udf_warn(sb, "bitmap inode efe not found but it's ok since the disc is mounted read-only\n"); | ||
1591 | else { | ||
1592 | udf_err(sb, "bitmap inode efe not found and attempted read-write mount\n"); | ||
1593 | - goto error_exit; | ||
1594 | + return -EIO; | ||
1595 | } | ||
1596 | } | ||
1597 | } | ||
1598 | |||
1599 | udf_debug("udf_load_metadata_files Ok\n"); | ||
1600 | - | ||
1601 | return 0; | ||
1602 | - | ||
1603 | -error_exit: | ||
1604 | - return 1; | ||
1605 | } | ||
1606 | |||
1607 | static void udf_load_fileset(struct super_block *sb, struct buffer_head *bh, | ||
1608 | @@ -1069,7 +1076,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, | ||
1609 | if (!map->s_uspace.s_table) { | ||
1610 | udf_debug("cannot load unallocSpaceTable (part %d)\n", | ||
1611 | p_index); | ||
1612 | - return 1; | ||
1613 | + return -EIO; | ||
1614 | } | ||
1615 | map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_TABLE; | ||
1616 | udf_debug("unallocSpaceTable (part %d) @ %ld\n", | ||
1617 | @@ -1079,7 +1086,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, | ||
1618 | if (phd->unallocSpaceBitmap.extLength) { | ||
1619 | struct udf_bitmap *bitmap = udf_sb_alloc_bitmap(sb, p_index); | ||
1620 | if (!bitmap) | ||
1621 | - return 1; | ||
1622 | + return -ENOMEM; | ||
1623 | map->s_uspace.s_bitmap = bitmap; | ||
1624 | bitmap->s_extPosition = le32_to_cpu( | ||
1625 | phd->unallocSpaceBitmap.extPosition); | ||
1626 | @@ -1102,7 +1109,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, | ||
1627 | if (!map->s_fspace.s_table) { | ||
1628 | udf_debug("cannot load freedSpaceTable (part %d)\n", | ||
1629 | p_index); | ||
1630 | - return 1; | ||
1631 | + return -EIO; | ||
1632 | } | ||
1633 | |||
1634 | map->s_partition_flags |= UDF_PART_FLAG_FREED_TABLE; | ||
1635 | @@ -1113,7 +1120,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, | ||
1636 | if (phd->freedSpaceBitmap.extLength) { | ||
1637 | struct udf_bitmap *bitmap = udf_sb_alloc_bitmap(sb, p_index); | ||
1638 | if (!bitmap) | ||
1639 | - return 1; | ||
1640 | + return -ENOMEM; | ||
1641 | map->s_fspace.s_bitmap = bitmap; | ||
1642 | bitmap->s_extPosition = le32_to_cpu( | ||
1643 | phd->freedSpaceBitmap.extPosition); | ||
1644 | @@ -1165,7 +1172,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) | ||
1645 | udf_find_vat_block(sb, p_index, type1_index, blocks - 1); | ||
1646 | } | ||
1647 | if (!sbi->s_vat_inode) | ||
1648 | - return 1; | ||
1649 | + return -EIO; | ||
1650 | |||
1651 | if (map->s_partition_type == UDF_VIRTUAL_MAP15) { | ||
1652 | map->s_type_specific.s_virtual.s_start_offset = 0; | ||
1653 | @@ -1177,7 +1184,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) | ||
1654 | pos = udf_block_map(sbi->s_vat_inode, 0); | ||
1655 | bh = sb_bread(sb, pos); | ||
1656 | if (!bh) | ||
1657 | - return 1; | ||
1658 | + return -EIO; | ||
1659 | vat20 = (struct virtualAllocationTable20 *)bh->b_data; | ||
1660 | } else { | ||
1661 | vat20 = (struct virtualAllocationTable20 *) | ||
1662 | @@ -1195,6 +1202,12 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) | ||
1663 | return 0; | ||
1664 | } | ||
1665 | |||
1666 | +/* | ||
1667 | + * Load partition descriptor block | ||
1668 | + * | ||
1669 | + * Returns <0 on error, 0 on success, -EAGAIN is special - try next descriptor | ||
1670 | + * sequence. | ||
1671 | + */ | ||
1672 | static int udf_load_partdesc(struct super_block *sb, sector_t block) | ||
1673 | { | ||
1674 | struct buffer_head *bh; | ||
1675 | @@ -1204,13 +1217,15 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) | ||
1676 | int i, type1_idx; | ||
1677 | uint16_t partitionNumber; | ||
1678 | uint16_t ident; | ||
1679 | - int ret = 0; | ||
1680 | + int ret; | ||
1681 | |||
1682 | bh = udf_read_tagged(sb, block, block, &ident); | ||
1683 | if (!bh) | ||
1684 | - return 1; | ||
1685 | - if (ident != TAG_IDENT_PD) | ||
1686 | + return -EAGAIN; | ||
1687 | + if (ident != TAG_IDENT_PD) { | ||
1688 | + ret = 0; | ||
1689 | goto out_bh; | ||
1690 | + } | ||
1691 | |||
1692 | p = (struct partitionDesc *)bh->b_data; | ||
1693 | partitionNumber = le16_to_cpu(p->partitionNumber); | ||
1694 | @@ -1229,10 +1244,13 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) | ||
1695 | if (i >= sbi->s_partitions) { | ||
1696 | udf_debug("Partition (%d) not found in partition map\n", | ||
1697 | partitionNumber); | ||
1698 | + ret = 0; | ||
1699 | goto out_bh; | ||
1700 | } | ||
1701 | |||
1702 | ret = udf_fill_partdesc_info(sb, p, i); | ||
1703 | + if (ret < 0) | ||
1704 | + goto out_bh; | ||
1705 | |||
1706 | /* | ||
1707 | * Now rescan for VIRTUAL or METADATA partitions when SPARABLE and | ||
1708 | @@ -1249,32 +1267,37 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) | ||
1709 | break; | ||
1710 | } | ||
1711 | |||
1712 | - if (i >= sbi->s_partitions) | ||
1713 | + if (i >= sbi->s_partitions) { | ||
1714 | + ret = 0; | ||
1715 | goto out_bh; | ||
1716 | + } | ||
1717 | |||
1718 | ret = udf_fill_partdesc_info(sb, p, i); | ||
1719 | - if (ret) | ||
1720 | + if (ret < 0) | ||
1721 | goto out_bh; | ||
1722 | |||
1723 | if (map->s_partition_type == UDF_METADATA_MAP25) { | ||
1724 | ret = udf_load_metadata_files(sb, i); | ||
1725 | - if (ret) { | ||
1726 | + if (ret < 0) { | ||
1727 | udf_err(sb, "error loading MetaData partition map %d\n", | ||
1728 | i); | ||
1729 | goto out_bh; | ||
1730 | } | ||
1731 | } else { | ||
1732 | - ret = udf_load_vat(sb, i, type1_idx); | ||
1733 | - if (ret) | ||
1734 | - goto out_bh; | ||
1735 | /* | ||
1736 | - * Mark filesystem read-only if we have a partition with | ||
1737 | - * virtual map since we don't handle writing to it (we | ||
1738 | - * overwrite blocks instead of relocating them). | ||
1739 | + * If we have a partition with virtual map, we don't handle | ||
1740 | + * writing to it (we overwrite blocks instead of relocating | ||
1741 | + * them). | ||
1742 | */ | ||
1743 | - sb->s_flags |= MS_RDONLY; | ||
1744 | - pr_notice("Filesystem marked read-only because writing to pseudooverwrite partition is not implemented\n"); | ||
1745 | + if (!(sb->s_flags & MS_RDONLY)) { | ||
1746 | + ret = -EACCES; | ||
1747 | + goto out_bh; | ||
1748 | + } | ||
1749 | + ret = udf_load_vat(sb, i, type1_idx); | ||
1750 | + if (ret < 0) | ||
1751 | + goto out_bh; | ||
1752 | } | ||
1753 | + ret = 0; | ||
1754 | out_bh: | ||
1755 | /* In case loading failed, we handle cleanup in udf_fill_super */ | ||
1756 | brelse(bh); | ||
1757 | @@ -1340,11 +1363,11 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, | ||
1758 | uint16_t ident; | ||
1759 | struct buffer_head *bh; | ||
1760 | unsigned int table_len; | ||
1761 | - int ret = 0; | ||
1762 | + int ret; | ||
1763 | |||
1764 | bh = udf_read_tagged(sb, block, block, &ident); | ||
1765 | if (!bh) | ||
1766 | - return 1; | ||
1767 | + return -EAGAIN; | ||
1768 | BUG_ON(ident != TAG_IDENT_LVD); | ||
1769 | lvd = (struct logicalVolDesc *)bh->b_data; | ||
1770 | table_len = le32_to_cpu(lvd->mapTableLength); | ||
1771 | @@ -1352,7 +1375,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, | ||
1772 | udf_err(sb, "error loading logical volume descriptor: " | ||
1773 | "Partition table too long (%u > %lu)\n", table_len, | ||
1774 | sb->s_blocksize - sizeof(*lvd)); | ||
1775 | - ret = 1; | ||
1776 | + ret = -EIO; | ||
1777 | goto out_bh; | ||
1778 | } | ||
1779 | |||
1780 | @@ -1396,11 +1419,10 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, | ||
1781 | } else if (!strncmp(upm2->partIdent.ident, | ||
1782 | UDF_ID_SPARABLE, | ||
1783 | strlen(UDF_ID_SPARABLE))) { | ||
1784 | - if (udf_load_sparable_map(sb, map, | ||
1785 | - (struct sparablePartitionMap *)gpm) < 0) { | ||
1786 | - ret = 1; | ||
1787 | + ret = udf_load_sparable_map(sb, map, | ||
1788 | + (struct sparablePartitionMap *)gpm); | ||
1789 | + if (ret < 0) | ||
1790 | goto out_bh; | ||
1791 | - } | ||
1792 | } else if (!strncmp(upm2->partIdent.ident, | ||
1793 | UDF_ID_METADATA, | ||
1794 | strlen(UDF_ID_METADATA))) { | ||
1795 | @@ -1465,7 +1487,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, | ||
1796 | } | ||
1797 | if (lvd->integritySeqExt.extLength) | ||
1798 | udf_load_logicalvolint(sb, leea_to_cpu(lvd->integritySeqExt)); | ||
1799 | - | ||
1800 | + ret = 0; | ||
1801 | out_bh: | ||
1802 | brelse(bh); | ||
1803 | return ret; | ||
1804 | @@ -1503,22 +1525,18 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ | ||
1805 | } | ||
1806 | |||
1807 | /* | ||
1808 | - * udf_process_sequence | ||
1809 | - * | ||
1810 | - * PURPOSE | ||
1811 | - * Process a main/reserve volume descriptor sequence. | ||
1812 | - * | ||
1813 | - * PRE-CONDITIONS | ||
1814 | - * sb Pointer to _locked_ superblock. | ||
1815 | - * block First block of first extent of the sequence. | ||
1816 | - * lastblock Lastblock of first extent of the sequence. | ||
1817 | + * Process a main/reserve volume descriptor sequence. | ||
1818 | + * @block First block of first extent of the sequence. | ||
1819 | + * @lastblock Lastblock of first extent of the sequence. | ||
1820 | + * @fileset There we store extent containing root fileset | ||
1821 | * | ||
1822 | - * HISTORY | ||
1823 | - * July 1, 1997 - Andrew E. Mileski | ||
1824 | - * Written, tested, and released. | ||
1825 | + * Returns <0 on error, 0 on success. -EAGAIN is special - try next descriptor | ||
1826 | + * sequence | ||
1827 | */ | ||
1828 | -static noinline int udf_process_sequence(struct super_block *sb, long block, | ||
1829 | - long lastblock, struct kernel_lb_addr *fileset) | ||
1830 | +static noinline int udf_process_sequence( | ||
1831 | + struct super_block *sb, | ||
1832 | + sector_t block, sector_t lastblock, | ||
1833 | + struct kernel_lb_addr *fileset) | ||
1834 | { | ||
1835 | struct buffer_head *bh = NULL; | ||
1836 | struct udf_vds_record vds[VDS_POS_LENGTH]; | ||
1837 | @@ -1529,6 +1547,7 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, | ||
1838 | uint32_t vdsn; | ||
1839 | uint16_t ident; | ||
1840 | long next_s = 0, next_e = 0; | ||
1841 | + int ret; | ||
1842 | |||
1843 | memset(vds, 0, sizeof(struct udf_vds_record) * VDS_POS_LENGTH); | ||
1844 | |||
1845 | @@ -1543,7 +1562,7 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, | ||
1846 | udf_err(sb, | ||
1847 | "Block %llu of volume descriptor sequence is corrupted or we could not read it\n", | ||
1848 | (unsigned long long)block); | ||
1849 | - return 1; | ||
1850 | + return -EAGAIN; | ||
1851 | } | ||
1852 | |||
1853 | /* Process each descriptor (ISO 13346 3/8.3-8.4) */ | ||
1854 | @@ -1616,14 +1635,19 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, | ||
1855 | */ | ||
1856 | if (!vds[VDS_POS_PRIMARY_VOL_DESC].block) { | ||
1857 | udf_err(sb, "Primary Volume Descriptor not found!\n"); | ||
1858 | - return 1; | ||
1859 | + return -EAGAIN; | ||
1860 | + } | ||
1861 | + ret = udf_load_pvoldesc(sb, vds[VDS_POS_PRIMARY_VOL_DESC].block); | ||
1862 | + if (ret < 0) | ||
1863 | + return ret; | ||
1864 | + | ||
1865 | + if (vds[VDS_POS_LOGICAL_VOL_DESC].block) { | ||
1866 | + ret = udf_load_logicalvol(sb, | ||
1867 | + vds[VDS_POS_LOGICAL_VOL_DESC].block, | ||
1868 | + fileset); | ||
1869 | + if (ret < 0) | ||
1870 | + return ret; | ||
1871 | } | ||
1872 | - if (udf_load_pvoldesc(sb, vds[VDS_POS_PRIMARY_VOL_DESC].block)) | ||
1873 | - return 1; | ||
1874 | - | ||
1875 | - if (vds[VDS_POS_LOGICAL_VOL_DESC].block && udf_load_logicalvol(sb, | ||
1876 | - vds[VDS_POS_LOGICAL_VOL_DESC].block, fileset)) | ||
1877 | - return 1; | ||
1878 | |||
1879 | if (vds[VDS_POS_PARTITION_DESC].block) { | ||
1880 | /* | ||
1881 | @@ -1632,19 +1656,27 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, | ||
1882 | */ | ||
1883 | for (block = vds[VDS_POS_PARTITION_DESC].block; | ||
1884 | block < vds[VDS_POS_TERMINATING_DESC].block; | ||
1885 | - block++) | ||
1886 | - if (udf_load_partdesc(sb, block)) | ||
1887 | - return 1; | ||
1888 | + block++) { | ||
1889 | + ret = udf_load_partdesc(sb, block); | ||
1890 | + if (ret < 0) | ||
1891 | + return ret; | ||
1892 | + } | ||
1893 | } | ||
1894 | |||
1895 | return 0; | ||
1896 | } | ||
1897 | |||
1898 | +/* | ||
1899 | + * Load Volume Descriptor Sequence described by anchor in bh | ||
1900 | + * | ||
1901 | + * Returns <0 on error, 0 on success | ||
1902 | + */ | ||
1903 | static int udf_load_sequence(struct super_block *sb, struct buffer_head *bh, | ||
1904 | struct kernel_lb_addr *fileset) | ||
1905 | { | ||
1906 | struct anchorVolDescPtr *anchor; | ||
1907 | - long main_s, main_e, reserve_s, reserve_e; | ||
1908 | + sector_t main_s, main_e, reserve_s, reserve_e; | ||
1909 | + int ret; | ||
1910 | |||
1911 | anchor = (struct anchorVolDescPtr *)bh->b_data; | ||
1912 | |||
1913 | @@ -1662,18 +1694,26 @@ static int udf_load_sequence(struct super_block *sb, struct buffer_head *bh, | ||
1914 | |||
1915 | /* Process the main & reserve sequences */ | ||
1916 | /* responsible for finding the PartitionDesc(s) */ | ||
1917 | - if (!udf_process_sequence(sb, main_s, main_e, fileset)) | ||
1918 | - return 1; | ||
1919 | - udf_sb_free_partitions(sb); | ||
1920 | - if (!udf_process_sequence(sb, reserve_s, reserve_e, fileset)) | ||
1921 | - return 1; | ||
1922 | + ret = udf_process_sequence(sb, main_s, main_e, fileset); | ||
1923 | + if (ret != -EAGAIN) | ||
1924 | + return ret; | ||
1925 | udf_sb_free_partitions(sb); | ||
1926 | - return 0; | ||
1927 | + ret = udf_process_sequence(sb, reserve_s, reserve_e, fileset); | ||
1928 | + if (ret < 0) { | ||
1929 | + udf_sb_free_partitions(sb); | ||
1930 | + /* No sequence was OK, return -EIO */ | ||
1931 | + if (ret == -EAGAIN) | ||
1932 | + ret = -EIO; | ||
1933 | + } | ||
1934 | + return ret; | ||
1935 | } | ||
1936 | |||
1937 | /* | ||
1938 | * Check whether there is an anchor block in the given block and | ||
1939 | * load Volume Descriptor Sequence if so. | ||
1940 | + * | ||
1941 | + * Returns <0 on error, 0 on success, -EAGAIN is special - try next anchor | ||
1942 | + * block | ||
1943 | */ | ||
1944 | static int udf_check_anchor_block(struct super_block *sb, sector_t block, | ||
1945 | struct kernel_lb_addr *fileset) | ||
1946 | @@ -1685,33 +1725,40 @@ static int udf_check_anchor_block(struct super_block *sb, sector_t block, | ||
1947 | if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV) && | ||
1948 | udf_fixed_to_variable(block) >= | ||
1949 | sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits) | ||
1950 | - return 0; | ||
1951 | + return -EAGAIN; | ||
1952 | |||
1953 | bh = udf_read_tagged(sb, block, block, &ident); | ||
1954 | if (!bh) | ||
1955 | - return 0; | ||
1956 | + return -EAGAIN; | ||
1957 | if (ident != TAG_IDENT_AVDP) { | ||
1958 | brelse(bh); | ||
1959 | - return 0; | ||
1960 | + return -EAGAIN; | ||
1961 | } | ||
1962 | ret = udf_load_sequence(sb, bh, fileset); | ||
1963 | brelse(bh); | ||
1964 | return ret; | ||
1965 | } | ||
1966 | |||
1967 | -/* Search for an anchor volume descriptor pointer */ | ||
1968 | -static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock, | ||
1969 | - struct kernel_lb_addr *fileset) | ||
1970 | +/* | ||
1971 | + * Search for an anchor volume descriptor pointer. | ||
1972 | + * | ||
1973 | + * Returns < 0 on error, 0 on success. -EAGAIN is special - try next set | ||
1974 | + * of anchors. | ||
1975 | + */ | ||
1976 | +static int udf_scan_anchors(struct super_block *sb, sector_t *lastblock, | ||
1977 | + struct kernel_lb_addr *fileset) | ||
1978 | { | ||
1979 | sector_t last[6]; | ||
1980 | int i; | ||
1981 | struct udf_sb_info *sbi = UDF_SB(sb); | ||
1982 | int last_count = 0; | ||
1983 | + int ret; | ||
1984 | |||
1985 | /* First try user provided anchor */ | ||
1986 | if (sbi->s_anchor) { | ||
1987 | - if (udf_check_anchor_block(sb, sbi->s_anchor, fileset)) | ||
1988 | - return lastblock; | ||
1989 | + ret = udf_check_anchor_block(sb, sbi->s_anchor, fileset); | ||
1990 | + if (ret != -EAGAIN) | ||
1991 | + return ret; | ||
1992 | } | ||
1993 | /* | ||
1994 | * according to spec, anchor is in either: | ||
1995 | @@ -1720,39 +1767,46 @@ static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock, | ||
1996 | * lastblock | ||
1997 | * however, if the disc isn't closed, it could be 512. | ||
1998 | */ | ||
1999 | - if (udf_check_anchor_block(sb, sbi->s_session + 256, fileset)) | ||
2000 | - return lastblock; | ||
2001 | + ret = udf_check_anchor_block(sb, sbi->s_session + 256, fileset); | ||
2002 | + if (ret != -EAGAIN) | ||
2003 | + return ret; | ||
2004 | /* | ||
2005 | * The trouble is which block is the last one. Drives often misreport | ||
2006 | * this so we try various possibilities. | ||
2007 | */ | ||
2008 | - last[last_count++] = lastblock; | ||
2009 | - if (lastblock >= 1) | ||
2010 | - last[last_count++] = lastblock - 1; | ||
2011 | - last[last_count++] = lastblock + 1; | ||
2012 | - if (lastblock >= 2) | ||
2013 | - last[last_count++] = lastblock - 2; | ||
2014 | - if (lastblock >= 150) | ||
2015 | - last[last_count++] = lastblock - 150; | ||
2016 | - if (lastblock >= 152) | ||
2017 | - last[last_count++] = lastblock - 152; | ||
2018 | + last[last_count++] = *lastblock; | ||
2019 | + if (*lastblock >= 1) | ||
2020 | + last[last_count++] = *lastblock - 1; | ||
2021 | + last[last_count++] = *lastblock + 1; | ||
2022 | + if (*lastblock >= 2) | ||
2023 | + last[last_count++] = *lastblock - 2; | ||
2024 | + if (*lastblock >= 150) | ||
2025 | + last[last_count++] = *lastblock - 150; | ||
2026 | + if (*lastblock >= 152) | ||
2027 | + last[last_count++] = *lastblock - 152; | ||
2028 | |||
2029 | for (i = 0; i < last_count; i++) { | ||
2030 | if (last[i] >= sb->s_bdev->bd_inode->i_size >> | ||
2031 | sb->s_blocksize_bits) | ||
2032 | continue; | ||
2033 | - if (udf_check_anchor_block(sb, last[i], fileset)) | ||
2034 | - return last[i]; | ||
2035 | + ret = udf_check_anchor_block(sb, last[i], fileset); | ||
2036 | + if (ret != -EAGAIN) { | ||
2037 | + if (!ret) | ||
2038 | + *lastblock = last[i]; | ||
2039 | + return ret; | ||
2040 | + } | ||
2041 | if (last[i] < 256) | ||
2042 | continue; | ||
2043 | - if (udf_check_anchor_block(sb, last[i] - 256, fileset)) | ||
2044 | - return last[i]; | ||
2045 | + ret = udf_check_anchor_block(sb, last[i] - 256, fileset); | ||
2046 | + if (ret != -EAGAIN) { | ||
2047 | + if (!ret) | ||
2048 | + *lastblock = last[i]; | ||
2049 | + return ret; | ||
2050 | + } | ||
2051 | } | ||
2052 | |||
2053 | /* Finally try block 512 in case media is open */ | ||
2054 | - if (udf_check_anchor_block(sb, sbi->s_session + 512, fileset)) | ||
2055 | - return last[0]; | ||
2056 | - return 0; | ||
2057 | + return udf_check_anchor_block(sb, sbi->s_session + 512, fileset); | ||
2058 | } | ||
2059 | |||
2060 | /* | ||
2061 | @@ -1760,54 +1814,59 @@ static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock, | ||
2062 | * area specified by it. The function expects sbi->s_lastblock to be the last | ||
2063 | * block on the media. | ||
2064 | * | ||
2065 | - * Return 1 if ok, 0 if not found. | ||
2066 | - * | ||
2067 | + * Return <0 on error, 0 if anchor found. -EAGAIN is special meaning anchor | ||
2068 | + * was not found. | ||
2069 | */ | ||
2070 | static int udf_find_anchor(struct super_block *sb, | ||
2071 | struct kernel_lb_addr *fileset) | ||
2072 | { | ||
2073 | - sector_t lastblock; | ||
2074 | struct udf_sb_info *sbi = UDF_SB(sb); | ||
2075 | + sector_t lastblock = sbi->s_last_block; | ||
2076 | + int ret; | ||
2077 | |||
2078 | - lastblock = udf_scan_anchors(sb, sbi->s_last_block, fileset); | ||
2079 | - if (lastblock) | ||
2080 | + ret = udf_scan_anchors(sb, &lastblock, fileset); | ||
2081 | + if (ret != -EAGAIN) | ||
2082 | goto out; | ||
2083 | |||
2084 | /* No anchor found? Try VARCONV conversion of block numbers */ | ||
2085 | UDF_SET_FLAG(sb, UDF_FLAG_VARCONV); | ||
2086 | + lastblock = udf_variable_to_fixed(sbi->s_last_block); | ||
2087 | /* Firstly, we try to not convert number of the last block */ | ||
2088 | - lastblock = udf_scan_anchors(sb, | ||
2089 | - udf_variable_to_fixed(sbi->s_last_block), | ||
2090 | - fileset); | ||
2091 | - if (lastblock) | ||
2092 | + ret = udf_scan_anchors(sb, &lastblock, fileset); | ||
2093 | + if (ret != -EAGAIN) | ||
2094 | goto out; | ||
2095 | |||
2096 | + lastblock = sbi->s_last_block; | ||
2097 | /* Secondly, we try with converted number of the last block */ | ||
2098 | - lastblock = udf_scan_anchors(sb, sbi->s_last_block, fileset); | ||
2099 | - if (!lastblock) { | ||
2100 | + ret = udf_scan_anchors(sb, &lastblock, fileset); | ||
2101 | + if (ret < 0) { | ||
2102 | /* VARCONV didn't help. Clear it. */ | ||
2103 | UDF_CLEAR_FLAG(sb, UDF_FLAG_VARCONV); | ||
2104 | - return 0; | ||
2105 | } | ||
2106 | out: | ||
2107 | - sbi->s_last_block = lastblock; | ||
2108 | - return 1; | ||
2109 | + if (ret == 0) | ||
2110 | + sbi->s_last_block = lastblock; | ||
2111 | + return ret; | ||
2112 | } | ||
2113 | |||
2114 | /* | ||
2115 | * Check Volume Structure Descriptor, find Anchor block and load Volume | ||
2116 | - * Descriptor Sequence | ||
2117 | + * Descriptor Sequence. | ||
2118 | + * | ||
2119 | + * Returns < 0 on error, 0 on success. -EAGAIN is special meaning anchor | ||
2120 | + * block was not found. | ||
2121 | */ | ||
2122 | static int udf_load_vrs(struct super_block *sb, struct udf_options *uopt, | ||
2123 | int silent, struct kernel_lb_addr *fileset) | ||
2124 | { | ||
2125 | struct udf_sb_info *sbi = UDF_SB(sb); | ||
2126 | loff_t nsr_off; | ||
2127 | + int ret; | ||
2128 | |||
2129 | if (!sb_set_blocksize(sb, uopt->blocksize)) { | ||
2130 | if (!silent) | ||
2131 | udf_warn(sb, "Bad block size\n"); | ||
2132 | - return 0; | ||
2133 | + return -EINVAL; | ||
2134 | } | ||
2135 | sbi->s_last_block = uopt->lastblock; | ||
2136 | if (!uopt->novrs) { | ||
2137 | @@ -1828,12 +1887,13 @@ static int udf_load_vrs(struct super_block *sb, struct udf_options *uopt, | ||
2138 | |||
2139 | /* Look for anchor block and load Volume Descriptor Sequence */ | ||
2140 | sbi->s_anchor = uopt->anchor; | ||
2141 | - if (!udf_find_anchor(sb, fileset)) { | ||
2142 | - if (!silent) | ||
2143 | + ret = udf_find_anchor(sb, fileset); | ||
2144 | + if (ret < 0) { | ||
2145 | + if (!silent && ret == -EAGAIN) | ||
2146 | udf_warn(sb, "No anchor found\n"); | ||
2147 | - return 0; | ||
2148 | + return ret; | ||
2149 | } | ||
2150 | - return 1; | ||
2151 | + return 0; | ||
2152 | } | ||
2153 | |||
2154 | static void udf_open_lvid(struct super_block *sb) | ||
2155 | @@ -1939,7 +1999,7 @@ u64 lvid_get_unique_id(struct super_block *sb) | ||
2156 | |||
2157 | static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2158 | { | ||
2159 | - int ret; | ||
2160 | + int ret = -EINVAL; | ||
2161 | struct inode *inode = NULL; | ||
2162 | struct udf_options uopt; | ||
2163 | struct kernel_lb_addr rootdir, fileset; | ||
2164 | @@ -2011,7 +2071,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2165 | } else { | ||
2166 | uopt.blocksize = bdev_logical_block_size(sb->s_bdev); | ||
2167 | ret = udf_load_vrs(sb, &uopt, silent, &fileset); | ||
2168 | - if (!ret && uopt.blocksize != UDF_DEFAULT_BLOCKSIZE) { | ||
2169 | + if (ret == -EAGAIN && uopt.blocksize != UDF_DEFAULT_BLOCKSIZE) { | ||
2170 | if (!silent) | ||
2171 | pr_notice("Rescanning with blocksize %d\n", | ||
2172 | UDF_DEFAULT_BLOCKSIZE); | ||
2173 | @@ -2021,8 +2081,11 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2174 | ret = udf_load_vrs(sb, &uopt, silent, &fileset); | ||
2175 | } | ||
2176 | } | ||
2177 | - if (!ret) { | ||
2178 | - udf_warn(sb, "No partition found (1)\n"); | ||
2179 | + if (ret < 0) { | ||
2180 | + if (ret == -EAGAIN) { | ||
2181 | + udf_warn(sb, "No partition found (1)\n"); | ||
2182 | + ret = -EINVAL; | ||
2183 | + } | ||
2184 | goto error_out; | ||
2185 | } | ||
2186 | |||
2187 | @@ -2040,9 +2103,13 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2188 | udf_err(sb, "minUDFReadRev=%x (max is %x)\n", | ||
2189 | le16_to_cpu(lvidiu->minUDFReadRev), | ||
2190 | UDF_MAX_READ_VERSION); | ||
2191 | + ret = -EINVAL; | ||
2192 | + goto error_out; | ||
2193 | + } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION && | ||
2194 | + !(sb->s_flags & MS_RDONLY)) { | ||
2195 | + ret = -EACCES; | ||
2196 | goto error_out; | ||
2197 | - } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION) | ||
2198 | - sb->s_flags |= MS_RDONLY; | ||
2199 | + } | ||
2200 | |||
2201 | sbi->s_udfrev = minUDFWriteRev; | ||
2202 | |||
2203 | @@ -2054,17 +2121,20 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2204 | |||
2205 | if (!sbi->s_partitions) { | ||
2206 | udf_warn(sb, "No partition found (2)\n"); | ||
2207 | + ret = -EINVAL; | ||
2208 | goto error_out; | ||
2209 | } | ||
2210 | |||
2211 | if (sbi->s_partmaps[sbi->s_partition].s_partition_flags & | ||
2212 | - UDF_PART_FLAG_READ_ONLY) { | ||
2213 | - pr_notice("Partition marked readonly; forcing readonly mount\n"); | ||
2214 | - sb->s_flags |= MS_RDONLY; | ||
2215 | + UDF_PART_FLAG_READ_ONLY && | ||
2216 | + !(sb->s_flags & MS_RDONLY)) { | ||
2217 | + ret = -EACCES; | ||
2218 | + goto error_out; | ||
2219 | } | ||
2220 | |||
2221 | if (udf_find_fileset(sb, &fileset, &rootdir)) { | ||
2222 | udf_warn(sb, "No fileset found\n"); | ||
2223 | + ret = -EINVAL; | ||
2224 | goto error_out; | ||
2225 | } | ||
2226 | |||
2227 | @@ -2086,6 +2156,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2228 | if (!inode) { | ||
2229 | udf_err(sb, "Error in udf_iget, block=%d, partition=%d\n", | ||
2230 | rootdir.logicalBlockNum, rootdir.partitionReferenceNum); | ||
2231 | + ret = -EIO; | ||
2232 | goto error_out; | ||
2233 | } | ||
2234 | |||
2235 | @@ -2093,6 +2164,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) | ||
2236 | sb->s_root = d_make_root(inode); | ||
2237 | if (!sb->s_root) { | ||
2238 | udf_err(sb, "Couldn't allocate root dentry\n"); | ||
2239 | + ret = -ENOMEM; | ||
2240 | goto error_out; | ||
2241 | } | ||
2242 | sb->s_maxbytes = MAX_LFS_FILESIZE; | ||
2243 | @@ -2113,7 +2185,7 @@ error_out: | ||
2244 | kfree(sbi); | ||
2245 | sb->s_fs_info = NULL; | ||
2246 | |||
2247 | - return -EINVAL; | ||
2248 | + return ret; | ||
2249 | } | ||
2250 | |||
2251 | void _udf_err(struct super_block *sb, const char *function, | ||
2252 | diff --git a/include/linux/hid.h b/include/linux/hid.h | ||
2253 | index ff545cc..6e18550 100644 | ||
2254 | --- a/include/linux/hid.h | ||
2255 | +++ b/include/linux/hid.h | ||
2256 | @@ -749,6 +749,10 @@ void hid_output_report(struct hid_report *report, __u8 *data); | ||
2257 | struct hid_device *hid_allocate_device(void); | ||
2258 | struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id); | ||
2259 | int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size); | ||
2260 | +struct hid_report *hid_validate_values(struct hid_device *hid, | ||
2261 | + unsigned int type, unsigned int id, | ||
2262 | + unsigned int field_index, | ||
2263 | + unsigned int report_counts); | ||
2264 | int hid_open_report(struct hid_device *device); | ||
2265 | int hid_check_keys_pressed(struct hid_device *hid); | ||
2266 | int hid_connect(struct hid_device *hid, unsigned int connect_mask); | ||
2267 | diff --git a/include/linux/timex.h b/include/linux/timex.h | ||
2268 | index b3726e6..dd3edd7 100644 | ||
2269 | --- a/include/linux/timex.h | ||
2270 | +++ b/include/linux/timex.h | ||
2271 | @@ -141,6 +141,7 @@ extern int do_adjtimex(struct timex *); | ||
2272 | extern void hardpps(const struct timespec *, const struct timespec *); | ||
2273 | |||
2274 | int read_current_timer(unsigned long *timer_val); | ||
2275 | +void ntp_notify_cmos_timer(void); | ||
2276 | |||
2277 | /* The clock frequency of the i8253/i8254 PIT */ | ||
2278 | #define PIT_TICK_RATE 1193182ul | ||
2279 | diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h | ||
2280 | index 321d4ac..fa8b3ad 100644 | ||
2281 | --- a/include/uapi/drm/radeon_drm.h | ||
2282 | +++ b/include/uapi/drm/radeon_drm.h | ||
2283 | @@ -979,6 +979,8 @@ struct drm_radeon_cs { | ||
2284 | #define RADEON_INFO_RING_WORKING 0x15 | ||
2285 | /* SI tile mode array */ | ||
2286 | #define RADEON_INFO_SI_TILE_MODE_ARRAY 0x16 | ||
2287 | +/* query if CP DMA is supported on the compute ring */ | ||
2288 | +#define RADEON_INFO_SI_CP_DMA_COMPUTE 0x17 | ||
2289 | |||
2290 | |||
2291 | struct drm_radeon_info { | ||
2292 | diff --git a/kernel/audit.c b/kernel/audit.c | ||
2293 | index 91e53d0..7b0e23a 100644 | ||
2294 | --- a/kernel/audit.c | ||
2295 | +++ b/kernel/audit.c | ||
2296 | @@ -1117,9 +1117,10 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, | ||
2297 | |||
2298 | sleep_time = timeout_start + audit_backlog_wait_time - | ||
2299 | jiffies; | ||
2300 | - if ((long)sleep_time > 0) | ||
2301 | + if ((long)sleep_time > 0) { | ||
2302 | wait_for_auditd(sleep_time); | ||
2303 | - continue; | ||
2304 | + continue; | ||
2305 | + } | ||
2306 | } | ||
2307 | if (audit_rate_check() && printk_ratelimit()) | ||
2308 | printk(KERN_WARNING | ||
2309 | diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c | ||
2310 | index b5ccba2..1101d92 100644 | ||
2311 | --- a/kernel/sched/cputime.c | ||
2312 | +++ b/kernel/sched/cputime.c | ||
2313 | @@ -558,7 +558,7 @@ static void cputime_adjust(struct task_cputime *curr, | ||
2314 | struct cputime *prev, | ||
2315 | cputime_t *ut, cputime_t *st) | ||
2316 | { | ||
2317 | - cputime_t rtime, stime, utime, total; | ||
2318 | + cputime_t rtime, stime, utime; | ||
2319 | |||
2320 | if (vtime_accounting_enabled()) { | ||
2321 | *ut = curr->utime; | ||
2322 | @@ -566,9 +566,6 @@ static void cputime_adjust(struct task_cputime *curr, | ||
2323 | return; | ||
2324 | } | ||
2325 | |||
2326 | - stime = curr->stime; | ||
2327 | - total = stime + curr->utime; | ||
2328 | - | ||
2329 | /* | ||
2330 | * Tick based cputime accounting depend on random scheduling | ||
2331 | * timeslices of a task to be interrupted or not by the timer. | ||
2332 | @@ -589,13 +586,19 @@ static void cputime_adjust(struct task_cputime *curr, | ||
2333 | if (prev->stime + prev->utime >= rtime) | ||
2334 | goto out; | ||
2335 | |||
2336 | - if (total) { | ||
2337 | + stime = curr->stime; | ||
2338 | + utime = curr->utime; | ||
2339 | + | ||
2340 | + if (utime == 0) { | ||
2341 | + stime = rtime; | ||
2342 | + } else if (stime == 0) { | ||
2343 | + utime = rtime; | ||
2344 | + } else { | ||
2345 | + cputime_t total = stime + utime; | ||
2346 | + | ||
2347 | stime = scale_stime((__force u64)stime, | ||
2348 | (__force u64)rtime, (__force u64)total); | ||
2349 | utime = rtime - stime; | ||
2350 | - } else { | ||
2351 | - stime = rtime; | ||
2352 | - utime = 0; | ||
2353 | } | ||
2354 | |||
2355 | /* | ||
2356 | diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c | ||
2357 | index 03b73be..009a62b 100644 | ||
2358 | --- a/kernel/sched/fair.c | ||
2359 | +++ b/kernel/sched/fair.c | ||
2360 | @@ -5778,11 +5778,15 @@ static void task_fork_fair(struct task_struct *p) | ||
2361 | cfs_rq = task_cfs_rq(current); | ||
2362 | curr = cfs_rq->curr; | ||
2363 | |||
2364 | - if (unlikely(task_cpu(p) != this_cpu)) { | ||
2365 | - rcu_read_lock(); | ||
2366 | - __set_task_cpu(p, this_cpu); | ||
2367 | - rcu_read_unlock(); | ||
2368 | - } | ||
2369 | + /* | ||
2370 | + * Not only the cpu but also the task_group of the parent might have | ||
2371 | + * been changed after parent->se.parent,cfs_rq were copied to | ||
2372 | + * child->se.parent,cfs_rq. So call __set_task_cpu() to make those | ||
2373 | + * of child point to valid ones. | ||
2374 | + */ | ||
2375 | + rcu_read_lock(); | ||
2376 | + __set_task_cpu(p, this_cpu); | ||
2377 | + rcu_read_unlock(); | ||
2378 | |||
2379 | update_curr(cfs_rq); | ||
2380 | |||
2381 | diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c | ||
2382 | index 8f5b3b9..bb22151 100644 | ||
2383 | --- a/kernel/time/ntp.c | ||
2384 | +++ b/kernel/time/ntp.c | ||
2385 | @@ -516,13 +516,13 @@ static void sync_cmos_clock(struct work_struct *work) | ||
2386 | schedule_delayed_work(&sync_cmos_work, timespec_to_jiffies(&next)); | ||
2387 | } | ||
2388 | |||
2389 | -static void notify_cmos_timer(void) | ||
2390 | +void ntp_notify_cmos_timer(void) | ||
2391 | { | ||
2392 | schedule_delayed_work(&sync_cmos_work, 0); | ||
2393 | } | ||
2394 | |||
2395 | #else | ||
2396 | -static inline void notify_cmos_timer(void) { } | ||
2397 | +void ntp_notify_cmos_timer(void) { } | ||
2398 | #endif | ||
2399 | |||
2400 | |||
2401 | @@ -687,8 +687,6 @@ int __do_adjtimex(struct timex *txc, struct timespec *ts, s32 *time_tai) | ||
2402 | if (!(time_status & STA_NANO)) | ||
2403 | txc->time.tv_usec /= NSEC_PER_USEC; | ||
2404 | |||
2405 | - notify_cmos_timer(); | ||
2406 | - | ||
2407 | return result; | ||
2408 | } | ||
2409 | |||
2410 | diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c | ||
2411 | index baeeb5c..fcc261c 100644 | ||
2412 | --- a/kernel/time/timekeeping.c | ||
2413 | +++ b/kernel/time/timekeeping.c | ||
2414 | @@ -1682,6 +1682,8 @@ int do_adjtimex(struct timex *txc) | ||
2415 | write_seqcount_end(&timekeeper_seq); | ||
2416 | raw_spin_unlock_irqrestore(&timekeeper_lock, flags); | ||
2417 | |||
2418 | + ntp_notify_cmos_timer(); | ||
2419 | + | ||
2420 | return ret; | ||
2421 | } | ||
2422 | |||
2423 | diff --git a/mm/swap.c b/mm/swap.c | ||
2424 | index dfd7d71..9f2225f 100644 | ||
2425 | --- a/mm/swap.c | ||
2426 | +++ b/mm/swap.c | ||
2427 | @@ -31,6 +31,7 @@ | ||
2428 | #include <linux/memcontrol.h> | ||
2429 | #include <linux/gfp.h> | ||
2430 | #include <linux/uio.h> | ||
2431 | +#include <linux/hugetlb.h> | ||
2432 | |||
2433 | #include "internal.h" | ||
2434 | |||
2435 | @@ -78,6 +79,19 @@ static void __put_compound_page(struct page *page) | ||
2436 | |||
2437 | static void put_compound_page(struct page *page) | ||
2438 | { | ||
2439 | + /* | ||
2440 | + * hugetlbfs pages cannot be split from under us. If this is a | ||
2441 | + * hugetlbfs page, check refcount on head page and release the page if | ||
2442 | + * the refcount becomes zero. | ||
2443 | + */ | ||
2444 | + if (PageHuge(page)) { | ||
2445 | + page = compound_head(page); | ||
2446 | + if (put_page_testzero(page)) | ||
2447 | + __put_compound_page(page); | ||
2448 | + | ||
2449 | + return; | ||
2450 | + } | ||
2451 | + | ||
2452 | if (unlikely(PageTail(page))) { | ||
2453 | /* __split_huge_page_refcount can run under us */ | ||
2454 | struct page *page_head = compound_trans_head(page); | ||
2455 | @@ -181,38 +195,51 @@ bool __get_page_tail(struct page *page) | ||
2456 | * proper PT lock that already serializes against | ||
2457 | * split_huge_page(). | ||
2458 | */ | ||
2459 | - unsigned long flags; | ||
2460 | bool got = false; | ||
2461 | - struct page *page_head = compound_trans_head(page); | ||
2462 | + struct page *page_head; | ||
2463 | |||
2464 | - if (likely(page != page_head && get_page_unless_zero(page_head))) { | ||
2465 | + /* | ||
2466 | + * If this is a hugetlbfs page it cannot be split under us. Simply | ||
2467 | + * increment refcount for the head page. | ||
2468 | + */ | ||
2469 | + if (PageHuge(page)) { | ||
2470 | + page_head = compound_head(page); | ||
2471 | + atomic_inc(&page_head->_count); | ||
2472 | + got = true; | ||
2473 | + } else { | ||
2474 | + unsigned long flags; | ||
2475 | + | ||
2476 | + page_head = compound_trans_head(page); | ||
2477 | + if (likely(page != page_head && | ||
2478 | + get_page_unless_zero(page_head))) { | ||
2479 | + | ||
2480 | + /* Ref to put_compound_page() comment. */ | ||
2481 | + if (PageSlab(page_head)) { | ||
2482 | + if (likely(PageTail(page))) { | ||
2483 | + __get_page_tail_foll(page, false); | ||
2484 | + return true; | ||
2485 | + } else { | ||
2486 | + put_page(page_head); | ||
2487 | + return false; | ||
2488 | + } | ||
2489 | + } | ||
2490 | |||
2491 | - /* Ref to put_compound_page() comment. */ | ||
2492 | - if (PageSlab(page_head)) { | ||
2493 | + /* | ||
2494 | + * page_head wasn't a dangling pointer but it | ||
2495 | + * may not be a head page anymore by the time | ||
2496 | + * we obtain the lock. That is ok as long as it | ||
2497 | + * can't be freed from under us. | ||
2498 | + */ | ||
2499 | + flags = compound_lock_irqsave(page_head); | ||
2500 | + /* here __split_huge_page_refcount won't run anymore */ | ||
2501 | if (likely(PageTail(page))) { | ||
2502 | __get_page_tail_foll(page, false); | ||
2503 | - return true; | ||
2504 | - } else { | ||
2505 | - put_page(page_head); | ||
2506 | - return false; | ||
2507 | + got = true; | ||
2508 | } | ||
2509 | + compound_unlock_irqrestore(page_head, flags); | ||
2510 | + if (unlikely(!got)) | ||
2511 | + put_page(page_head); | ||
2512 | } | ||
2513 | - | ||
2514 | - /* | ||
2515 | - * page_head wasn't a dangling pointer but it | ||
2516 | - * may not be a head page anymore by the time | ||
2517 | - * we obtain the lock. That is ok as long as it | ||
2518 | - * can't be freed from under us. | ||
2519 | - */ | ||
2520 | - flags = compound_lock_irqsave(page_head); | ||
2521 | - /* here __split_huge_page_refcount won't run anymore */ | ||
2522 | - if (likely(PageTail(page))) { | ||
2523 | - __get_page_tail_foll(page, false); | ||
2524 | - got = true; | ||
2525 | - } | ||
2526 | - compound_unlock_irqrestore(page_head, flags); | ||
2527 | - if (unlikely(!got)) | ||
2528 | - put_page(page_head); | ||
2529 | } | ||
2530 | return got; | ||
2531 | } | ||
2532 | diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h | ||
2533 | index 57beb17..707bc52 100644 | ||
2534 | --- a/net/netfilter/ipset/ip_set_hash_gen.h | ||
2535 | +++ b/net/netfilter/ipset/ip_set_hash_gen.h | ||
2536 | @@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length) | ||
2537 | static void | ||
2538 | mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length) | ||
2539 | { | ||
2540 | - u8 i, j; | ||
2541 | - | ||
2542 | - for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++) | ||
2543 | - ; | ||
2544 | - h->nets[i].nets--; | ||
2545 | - | ||
2546 | - if (h->nets[i].nets != 0) | ||
2547 | - return; | ||
2548 | - | ||
2549 | - for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) { | ||
2550 | - h->nets[j].cidr = h->nets[j + 1].cidr; | ||
2551 | - h->nets[j].nets = h->nets[j + 1].nets; | ||
2552 | + u8 i, j, net_end = nets_length - 1; | ||
2553 | + | ||
2554 | + for (i = 0; i < nets_length; i++) { | ||
2555 | + if (h->nets[i].cidr != cidr) | ||
2556 | + continue; | ||
2557 | + if (h->nets[i].nets > 1 || i == net_end || | ||
2558 | + h->nets[i + 1].nets == 0) { | ||
2559 | + h->nets[i].nets--; | ||
2560 | + return; | ||
2561 | + } | ||
2562 | + for (j = i; j < net_end && h->nets[j].nets; j++) { | ||
2563 | + h->nets[j].cidr = h->nets[j + 1].cidr; | ||
2564 | + h->nets[j].nets = h->nets[j + 1].nets; | ||
2565 | + } | ||
2566 | + h->nets[j].nets = 0; | ||
2567 | + return; | ||
2568 | } | ||
2569 | } | ||
2570 | #endif | ||
2571 | diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c | ||
2572 | index af7ffd4..f1eb0d1 100644 | ||
2573 | --- a/net/sunrpc/auth_gss/gss_rpc_upcall.c | ||
2574 | +++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c | ||
2575 | @@ -213,6 +213,26 @@ static int gssp_call(struct net *net, struct rpc_message *msg) | ||
2576 | return status; | ||
2577 | } | ||
2578 | |||
2579 | +static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg) | ||
2580 | +{ | ||
2581 | + int i; | ||
2582 | + | ||
2583 | + for (i = 0; i < arg->npages && arg->pages[i]; i++) | ||
2584 | + __free_page(arg->pages[i]); | ||
2585 | +} | ||
2586 | + | ||
2587 | +static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg) | ||
2588 | +{ | ||
2589 | + arg->npages = DIV_ROUND_UP(NGROUPS_MAX * 4, PAGE_SIZE); | ||
2590 | + arg->pages = kzalloc(arg->npages * sizeof(struct page *), GFP_KERNEL); | ||
2591 | + /* | ||
2592 | + * XXX: actual pages are allocated by xdr layer in | ||
2593 | + * xdr_partial_copy_from_skb. | ||
2594 | + */ | ||
2595 | + if (!arg->pages) | ||
2596 | + return -ENOMEM; | ||
2597 | + return 0; | ||
2598 | +} | ||
2599 | |||
2600 | /* | ||
2601 | * Public functions | ||
2602 | @@ -261,10 +281,16 @@ int gssp_accept_sec_context_upcall(struct net *net, | ||
2603 | arg.context_handle = &ctxh; | ||
2604 | res.output_token->len = GSSX_max_output_token_sz; | ||
2605 | |||
2606 | + ret = gssp_alloc_receive_pages(&arg); | ||
2607 | + if (ret) | ||
2608 | + return ret; | ||
2609 | + | ||
2610 | /* use nfs/ for targ_name ? */ | ||
2611 | |||
2612 | ret = gssp_call(net, &msg); | ||
2613 | |||
2614 | + gssp_free_receive_pages(&arg); | ||
2615 | + | ||
2616 | /* we need to fetch all data even in case of error so | ||
2617 | * that we can free special strctures is they have been allocated */ | ||
2618 | data->major_status = res.status.major_status; | ||
2619 | diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c | ||
2620 | index 3c85d1c..f0f78c5 100644 | ||
2621 | --- a/net/sunrpc/auth_gss/gss_rpc_xdr.c | ||
2622 | +++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c | ||
2623 | @@ -166,14 +166,15 @@ static int dummy_dec_opt_array(struct xdr_stream *xdr, | ||
2624 | return 0; | ||
2625 | } | ||
2626 | |||
2627 | -static int get_s32(void **p, void *max, s32 *res) | ||
2628 | +static int get_host_u32(struct xdr_stream *xdr, u32 *res) | ||
2629 | { | ||
2630 | - void *base = *p; | ||
2631 | - void *next = (void *)((char *)base + sizeof(s32)); | ||
2632 | - if (unlikely(next > max || next < base)) | ||
2633 | + __be32 *p; | ||
2634 | + | ||
2635 | + p = xdr_inline_decode(xdr, 4); | ||
2636 | + if (!p) | ||
2637 | return -EINVAL; | ||
2638 | - memcpy(res, base, sizeof(s32)); | ||
2639 | - *p = next; | ||
2640 | + /* Contents of linux creds are all host-endian: */ | ||
2641 | + memcpy(res, p, sizeof(u32)); | ||
2642 | return 0; | ||
2643 | } | ||
2644 | |||
2645 | @@ -182,9 +183,9 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, | ||
2646 | { | ||
2647 | u32 length; | ||
2648 | __be32 *p; | ||
2649 | - void *q, *end; | ||
2650 | - s32 tmp; | ||
2651 | - int N, i, err; | ||
2652 | + u32 tmp; | ||
2653 | + u32 N; | ||
2654 | + int i, err; | ||
2655 | |||
2656 | p = xdr_inline_decode(xdr, 4); | ||
2657 | if (unlikely(p == NULL)) | ||
2658 | @@ -192,33 +193,28 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, | ||
2659 | |||
2660 | length = be32_to_cpup(p); | ||
2661 | |||
2662 | - /* FIXME: we do not want to use the scratch buffer for this one | ||
2663 | - * may need to use functions that allows us to access an io vector | ||
2664 | - * directly */ | ||
2665 | - p = xdr_inline_decode(xdr, length); | ||
2666 | - if (unlikely(p == NULL)) | ||
2667 | + if (length > (3 + NGROUPS_MAX) * sizeof(u32)) | ||
2668 | return -ENOSPC; | ||
2669 | |||
2670 | - q = p; | ||
2671 | - end = q + length; | ||
2672 | - | ||
2673 | /* uid */ | ||
2674 | - err = get_s32(&q, end, &tmp); | ||
2675 | + err = get_host_u32(xdr, &tmp); | ||
2676 | if (err) | ||
2677 | return err; | ||
2678 | creds->cr_uid = make_kuid(&init_user_ns, tmp); | ||
2679 | |||
2680 | /* gid */ | ||
2681 | - err = get_s32(&q, end, &tmp); | ||
2682 | + err = get_host_u32(xdr, &tmp); | ||
2683 | if (err) | ||
2684 | return err; | ||
2685 | creds->cr_gid = make_kgid(&init_user_ns, tmp); | ||
2686 | |||
2687 | /* number of additional gid's */ | ||
2688 | - err = get_s32(&q, end, &tmp); | ||
2689 | + err = get_host_u32(xdr, &tmp); | ||
2690 | if (err) | ||
2691 | return err; | ||
2692 | N = tmp; | ||
2693 | + if ((3 + N) * sizeof(u32) != length) | ||
2694 | + return -EINVAL; | ||
2695 | creds->cr_group_info = groups_alloc(N); | ||
2696 | if (creds->cr_group_info == NULL) | ||
2697 | return -ENOMEM; | ||
2698 | @@ -226,7 +222,7 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, | ||
2699 | /* gid's */ | ||
2700 | for (i = 0; i < N; i++) { | ||
2701 | kgid_t kgid; | ||
2702 | - err = get_s32(&q, end, &tmp); | ||
2703 | + err = get_host_u32(xdr, &tmp); | ||
2704 | if (err) | ||
2705 | goto out_free_groups; | ||
2706 | err = -EINVAL; | ||
2707 | @@ -784,6 +780,9 @@ void gssx_enc_accept_sec_context(struct rpc_rqst *req, | ||
2708 | /* arg->options */ | ||
2709 | err = dummy_enc_opt_array(xdr, &arg->options); | ||
2710 | |||
2711 | + xdr_inline_pages(&req->rq_rcv_buf, | ||
2712 | + PAGE_SIZE/2 /* pretty arbitrary */, | ||
2713 | + arg->pages, 0 /* page base */, arg->npages * PAGE_SIZE); | ||
2714 | done: | ||
2715 | if (err) | ||
2716 | dprintk("RPC: gssx_enc_accept_sec_context: %d\n", err); | ||
2717 | diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.h b/net/sunrpc/auth_gss/gss_rpc_xdr.h | ||
2718 | index 1c98b27..685a688 100644 | ||
2719 | --- a/net/sunrpc/auth_gss/gss_rpc_xdr.h | ||
2720 | +++ b/net/sunrpc/auth_gss/gss_rpc_xdr.h | ||
2721 | @@ -147,6 +147,8 @@ struct gssx_arg_accept_sec_context { | ||
2722 | struct gssx_cb *input_cb; | ||
2723 | u32 ret_deleg_cred; | ||
2724 | struct gssx_option_array options; | ||
2725 | + struct page **pages; | ||
2726 | + unsigned int npages; | ||
2727 | }; | ||
2728 | |||
2729 | struct gssx_res_accept_sec_context { | ||
2730 | @@ -240,7 +242,8 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, | ||
2731 | 2 * GSSX_max_princ_sz + \ | ||
2732 | 8 + 8 + 4 + 4 + 4) | ||
2733 | #define GSSX_max_output_token_sz 1024 | ||
2734 | -#define GSSX_max_creds_sz (4 + 4 + 4 + NGROUPS_MAX * 4) | ||
2735 | +/* grouplist not included; we allocate separate pages for that: */ | ||
2736 | +#define GSSX_max_creds_sz (4 + 4 + 4 /* + NGROUPS_MAX*4 */) | ||
2737 | #define GSSX_RES_accept_sec_context_sz (GSSX_default_status_sz + \ | ||
2738 | GSSX_default_ctx_sz + \ | ||
2739 | GSSX_max_output_token_sz + \ | ||
2740 | diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c | ||
2741 | index 6fcb9de..8bcdf9e 100644 | ||
2742 | --- a/tools/perf/util/map.c | ||
2743 | +++ b/tools/perf/util/map.c | ||
2744 | @@ -21,6 +21,7 @@ const char *map_type__name[MAP__NR_TYPES] = { | ||
2745 | static inline int is_anon_memory(const char *filename) | ||
2746 | { | ||
2747 | return !strcmp(filename, "//anon") || | ||
2748 | + !strcmp(filename, "/dev/zero (deleted)") || | ||
2749 | !strcmp(filename, "/anon_hugepage (deleted)"); | ||
2750 | } | ||
2751 |