Contents of /trunk/kernel26-alx/patches-3.10/0113-3.10.14-all-fixes.patch
Parent Directory | Revision Log
Revision 2672 -
(show annotations)
(download)
Tue Jul 21 16:46:35 2015 UTC (9 years, 2 months ago) by niro
File size: 88258 byte(s)
Tue Jul 21 16:46:35 2015 UTC (9 years, 2 months ago) by niro
File size: 88258 byte(s)
-3.10.84-alx-r1
1 | diff --git a/Makefile b/Makefile |
2 | index 25d38b7..129c49f 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 3 |
7 | PATCHLEVEL = 10 |
8 | -SUBLEVEL = 13 |
9 | +SUBLEVEL = 14 |
10 | EXTRAVERSION = |
11 | NAME = TOSSUG Baby Fish |
12 | |
13 | diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c |
14 | index d5bbdcf..c410752 100644 |
15 | --- a/block/cfq-iosched.c |
16 | +++ b/block/cfq-iosched.c |
17 | @@ -1803,7 +1803,7 @@ static u64 cfqg_prfill_avg_queue_size(struct seq_file *sf, |
18 | |
19 | if (samples) { |
20 | v = blkg_stat_read(&cfqg->stats.avg_queue_size_sum); |
21 | - do_div(v, samples); |
22 | + v = div64_u64(v, samples); |
23 | } |
24 | __blkg_prfill_u64(sf, pd, v); |
25 | return 0; |
26 | diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h |
27 | index 02e52d5..b6b7d70 100644 |
28 | --- a/drivers/gpu/drm/ast/ast_drv.h |
29 | +++ b/drivers/gpu/drm/ast/ast_drv.h |
30 | @@ -177,7 +177,7 @@ uint8_t ast_get_index_reg_mask(struct ast_private *ast, |
31 | |
32 | static inline void ast_open_key(struct ast_private *ast) |
33 | { |
34 | - ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xA1, 0xFF, 0x04); |
35 | + ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0x80, 0xA8); |
36 | } |
37 | |
38 | #define AST_VIDMEM_SIZE_8M 0x00800000 |
39 | diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c |
40 | index e7e9242..8759d69 100644 |
41 | --- a/drivers/gpu/drm/drm_crtc.c |
42 | +++ b/drivers/gpu/drm/drm_crtc.c |
43 | @@ -2501,10 +2501,22 @@ int drm_mode_getfb(struct drm_device *dev, |
44 | r->depth = fb->depth; |
45 | r->bpp = fb->bits_per_pixel; |
46 | r->pitch = fb->pitches[0]; |
47 | - if (fb->funcs->create_handle) |
48 | - ret = fb->funcs->create_handle(fb, file_priv, &r->handle); |
49 | - else |
50 | + if (fb->funcs->create_handle) { |
51 | + if (file_priv->is_master || capable(CAP_SYS_ADMIN)) { |
52 | + ret = fb->funcs->create_handle(fb, file_priv, |
53 | + &r->handle); |
54 | + } else { |
55 | + /* GET_FB() is an unprivileged ioctl so we must not |
56 | + * return a buffer-handle to non-master processes! For |
57 | + * backwards-compatibility reasons, we cannot make |
58 | + * GET_FB() privileged, so just return an invalid handle |
59 | + * for non-masters. */ |
60 | + r->handle = 0; |
61 | + ret = 0; |
62 | + } |
63 | + } else { |
64 | ret = -ENODEV; |
65 | + } |
66 | |
67 | drm_framebuffer_unreference(fb); |
68 | |
69 | diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c |
70 | index e5e32869..c8d16a6 100644 |
71 | --- a/drivers/gpu/drm/i915/i915_irq.c |
72 | +++ b/drivers/gpu/drm/i915/i915_irq.c |
73 | @@ -1009,6 +1009,34 @@ done: |
74 | return ret; |
75 | } |
76 | |
77 | +static void i915_error_wake_up(struct drm_i915_private *dev_priv, |
78 | + bool reset_completed) |
79 | +{ |
80 | + struct intel_ring_buffer *ring; |
81 | + int i; |
82 | + |
83 | + /* |
84 | + * Notify all waiters for GPU completion events that reset state has |
85 | + * been changed, and that they need to restart their wait after |
86 | + * checking for potential errors (and bail out to drop locks if there is |
87 | + * a gpu reset pending so that i915_error_work_func can acquire them). |
88 | + */ |
89 | + |
90 | + /* Wake up __wait_seqno, potentially holding dev->struct_mutex. */ |
91 | + for_each_ring(ring, dev_priv, i) |
92 | + wake_up_all(&ring->irq_queue); |
93 | + |
94 | + /* Wake up intel_crtc_wait_for_pending_flips, holding crtc->mutex. */ |
95 | + wake_up_all(&dev_priv->pending_flip_queue); |
96 | + |
97 | + /* |
98 | + * Signal tasks blocked in i915_gem_wait_for_error that the pending |
99 | + * reset state is cleared. |
100 | + */ |
101 | + if (reset_completed) |
102 | + wake_up_all(&dev_priv->gpu_error.reset_queue); |
103 | +} |
104 | + |
105 | /** |
106 | * i915_error_work_func - do process context error handling work |
107 | * @work: work struct |
108 | @@ -1023,11 +1051,10 @@ static void i915_error_work_func(struct work_struct *work) |
109 | drm_i915_private_t *dev_priv = container_of(error, drm_i915_private_t, |
110 | gpu_error); |
111 | struct drm_device *dev = dev_priv->dev; |
112 | - struct intel_ring_buffer *ring; |
113 | char *error_event[] = { "ERROR=1", NULL }; |
114 | char *reset_event[] = { "RESET=1", NULL }; |
115 | char *reset_done_event[] = { "ERROR=0", NULL }; |
116 | - int i, ret; |
117 | + int ret; |
118 | |
119 | kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, error_event); |
120 | |
121 | @@ -1046,8 +1073,16 @@ static void i915_error_work_func(struct work_struct *work) |
122 | kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, |
123 | reset_event); |
124 | |
125 | + /* |
126 | + * All state reset _must_ be completed before we update the |
127 | + * reset counter, for otherwise waiters might miss the reset |
128 | + * pending state and not properly drop locks, resulting in |
129 | + * deadlocks with the reset work. |
130 | + */ |
131 | ret = i915_reset(dev); |
132 | |
133 | + intel_display_handle_reset(dev); |
134 | + |
135 | if (ret == 0) { |
136 | /* |
137 | * After all the gem state is reset, increment the reset |
138 | @@ -1068,12 +1103,11 @@ static void i915_error_work_func(struct work_struct *work) |
139 | atomic_set(&error->reset_counter, I915_WEDGED); |
140 | } |
141 | |
142 | - for_each_ring(ring, dev_priv, i) |
143 | - wake_up_all(&ring->irq_queue); |
144 | - |
145 | - intel_display_handle_reset(dev); |
146 | - |
147 | - wake_up_all(&dev_priv->gpu_error.reset_queue); |
148 | + /* |
149 | + * Note: The wake_up also serves as a memory barrier so that |
150 | + * waiters see the update value of the reset counter atomic_t. |
151 | + */ |
152 | + i915_error_wake_up(dev_priv, true); |
153 | } |
154 | } |
155 | |
156 | @@ -1709,8 +1743,6 @@ static void i915_report_and_clear_eir(struct drm_device *dev) |
157 | void i915_handle_error(struct drm_device *dev, bool wedged) |
158 | { |
159 | struct drm_i915_private *dev_priv = dev->dev_private; |
160 | - struct intel_ring_buffer *ring; |
161 | - int i; |
162 | |
163 | i915_capture_error_state(dev); |
164 | i915_report_and_clear_eir(dev); |
165 | @@ -1720,14 +1752,28 @@ void i915_handle_error(struct drm_device *dev, bool wedged) |
166 | &dev_priv->gpu_error.reset_counter); |
167 | |
168 | /* |
169 | - * Wakeup waiting processes so that the reset work item |
170 | - * doesn't deadlock trying to grab various locks. |
171 | + * Wakeup waiting processes so that the reset work function |
172 | + * i915_error_work_func doesn't deadlock trying to grab various |
173 | + * locks. By bumping the reset counter first, the woken |
174 | + * processes will see a reset in progress and back off, |
175 | + * releasing their locks and then wait for the reset completion. |
176 | + * We must do this for _all_ gpu waiters that might hold locks |
177 | + * that the reset work needs to acquire. |
178 | + * |
179 | + * Note: The wake_up serves as the required memory barrier to |
180 | + * ensure that the waiters see the updated value of the reset |
181 | + * counter atomic_t. |
182 | */ |
183 | - for_each_ring(ring, dev_priv, i) |
184 | - wake_up_all(&ring->irq_queue); |
185 | + i915_error_wake_up(dev_priv, false); |
186 | } |
187 | |
188 | - queue_work(dev_priv->wq, &dev_priv->gpu_error.work); |
189 | + /* |
190 | + * Our reset work can grab modeset locks (since it needs to reset the |
191 | + * state of outstanding pagelips). Hence it must not be run on our own |
192 | + * dev-priv->wq work queue for otherwise the flush_work in the pageflip |
193 | + * code will deadlock. |
194 | + */ |
195 | + schedule_work(&dev_priv->gpu_error.work); |
196 | } |
197 | |
198 | static void __always_unused i915_pageflip_stall_check(struct drm_device *dev, int pipe) |
199 | diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c |
200 | index f02fd9f..a66b27c 100644 |
201 | --- a/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c |
202 | +++ b/drivers/gpu/drm/nouveau/core/engine/disp/dacnv50.c |
203 | @@ -49,18 +49,23 @@ int |
204 | nv50_dac_sense(struct nv50_disp_priv *priv, int or, u32 loadval) |
205 | { |
206 | const u32 doff = (or * 0x800); |
207 | - int load = -EINVAL; |
208 | + |
209 | nv_mask(priv, 0x61a004 + doff, 0x807f0000, 0x80150000); |
210 | nv_wait(priv, 0x61a004 + doff, 0x80000000, 0x00000000); |
211 | + |
212 | nv_wr32(priv, 0x61a00c + doff, 0x00100000 | loadval); |
213 | mdelay(9); |
214 | udelay(500); |
215 | - nv_wr32(priv, 0x61a00c + doff, 0x80000000); |
216 | - load = (nv_rd32(priv, 0x61a00c + doff) & 0x38000000) >> 27; |
217 | - nv_wr32(priv, 0x61a00c + doff, 0x00000000); |
218 | + loadval = nv_mask(priv, 0x61a00c + doff, 0xffffffff, 0x00000000); |
219 | + |
220 | nv_mask(priv, 0x61a004 + doff, 0x807f0000, 0x80550000); |
221 | nv_wait(priv, 0x61a004 + doff, 0x80000000, 0x00000000); |
222 | - return load; |
223 | + |
224 | + nv_debug(priv, "DAC%d sense: 0x%08x\n", or, loadval); |
225 | + if (!(loadval & 0x80000000)) |
226 | + return -ETIMEDOUT; |
227 | + |
228 | + return (loadval & 0x38000000) >> 27; |
229 | } |
230 | |
231 | int |
232 | diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c |
233 | index 32501f6..1602398 100644 |
234 | --- a/drivers/gpu/drm/radeon/atombios_dp.c |
235 | +++ b/drivers/gpu/drm/radeon/atombios_dp.c |
236 | @@ -50,7 +50,7 @@ static char *pre_emph_names[] = { |
237 | * or from atom. Note that atom operates on |
238 | * dw units. |
239 | */ |
240 | -static void radeon_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le) |
241 | +void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le) |
242 | { |
243 | #ifdef __BIG_ENDIAN |
244 | u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */ |
245 | @@ -100,7 +100,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan, |
246 | |
247 | base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1); |
248 | |
249 | - radeon_copy_swap(base, send, send_bytes, true); |
250 | + radeon_atom_copy_swap(base, send, send_bytes, true); |
251 | |
252 | args.v1.lpAuxRequest = cpu_to_le16((u16)(0 + 4)); |
253 | args.v1.lpDataOut = cpu_to_le16((u16)(16 + 4)); |
254 | @@ -137,7 +137,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan, |
255 | recv_bytes = recv_size; |
256 | |
257 | if (recv && recv_size) |
258 | - radeon_copy_swap(recv, base + 16, recv_bytes, false); |
259 | + radeon_atom_copy_swap(recv, base + 16, recv_bytes, false); |
260 | |
261 | return recv_bytes; |
262 | } |
263 | diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c |
264 | index 4120d35..c272d88 100644 |
265 | --- a/drivers/gpu/drm/radeon/atombios_encoders.c |
266 | +++ b/drivers/gpu/drm/radeon/atombios_encoders.c |
267 | @@ -1636,8 +1636,12 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode) |
268 | atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0); |
269 | atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0); |
270 | atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0); |
271 | - /* some early dce3.2 boards have a bug in their transmitter control table */ |
272 | - if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730)) |
273 | + /* some dce3.x boards have a bug in their transmitter control table. |
274 | + * ACTION_ENABLE_OUTPUT can probably be dropped since ACTION_ENABLE |
275 | + * does the same thing and more. |
276 | + */ |
277 | + if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) && |
278 | + (rdev->family != CHIP_RS880)) |
279 | atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0); |
280 | } |
281 | if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) { |
282 | diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c |
283 | index 082338d..2ca389d 100644 |
284 | --- a/drivers/gpu/drm/radeon/atombios_i2c.c |
285 | +++ b/drivers/gpu/drm/radeon/atombios_i2c.c |
286 | @@ -27,6 +27,8 @@ |
287 | #include "radeon.h" |
288 | #include "atom.h" |
289 | |
290 | +extern void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le); |
291 | + |
292 | #define TARGET_HW_I2C_CLOCK 50 |
293 | |
294 | /* these are a limitation of ProcessI2cChannelTransaction not the hw */ |
295 | @@ -77,7 +79,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan, |
296 | } |
297 | |
298 | if (!(flags & HW_I2C_WRITE)) |
299 | - memcpy(buf, base, num); |
300 | + radeon_atom_copy_swap(buf, base, num, false); |
301 | |
302 | return 0; |
303 | } |
304 | diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c |
305 | index 687b421..2068df1 100644 |
306 | --- a/drivers/gpu/drm/radeon/evergreen.c |
307 | +++ b/drivers/gpu/drm/radeon/evergreen.c |
308 | @@ -1718,7 +1718,8 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev, |
309 | struct drm_display_mode *mode, |
310 | struct drm_display_mode *other_mode) |
311 | { |
312 | - u32 tmp; |
313 | + u32 tmp, buffer_alloc, i; |
314 | + u32 pipe_offset = radeon_crtc->crtc_id * 0x20; |
315 | /* |
316 | * Line Buffer Setup |
317 | * There are 3 line buffers, each one shared by 2 display controllers. |
318 | @@ -1741,18 +1742,34 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev, |
319 | * non-linked crtcs for maximum line buffer allocation. |
320 | */ |
321 | if (radeon_crtc->base.enabled && mode) { |
322 | - if (other_mode) |
323 | + if (other_mode) { |
324 | tmp = 0; /* 1/2 */ |
325 | - else |
326 | + buffer_alloc = 1; |
327 | + } else { |
328 | tmp = 2; /* whole */ |
329 | - } else |
330 | + buffer_alloc = 2; |
331 | + } |
332 | + } else { |
333 | tmp = 0; |
334 | + buffer_alloc = 0; |
335 | + } |
336 | |
337 | /* second controller of the pair uses second half of the lb */ |
338 | if (radeon_crtc->crtc_id % 2) |
339 | tmp += 4; |
340 | WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, tmp); |
341 | |
342 | + if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) { |
343 | + WREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset, |
344 | + DMIF_BUFFERS_ALLOCATED(buffer_alloc)); |
345 | + for (i = 0; i < rdev->usec_timeout; i++) { |
346 | + if (RREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset) & |
347 | + DMIF_BUFFERS_ALLOCATED_COMPLETED) |
348 | + break; |
349 | + udelay(1); |
350 | + } |
351 | + } |
352 | + |
353 | if (radeon_crtc->base.enabled && mode) { |
354 | switch (tmp) { |
355 | case 0: |
356 | diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h |
357 | index 75c0563..9490972 100644 |
358 | --- a/drivers/gpu/drm/radeon/evergreend.h |
359 | +++ b/drivers/gpu/drm/radeon/evergreend.h |
360 | @@ -810,6 +810,10 @@ |
361 | # define LATENCY_LOW_WATERMARK(x) ((x) << 0) |
362 | # define LATENCY_HIGH_WATERMARK(x) ((x) << 16) |
363 | |
364 | +#define PIPE0_DMIF_BUFFER_CONTROL 0x0ca0 |
365 | +# define DMIF_BUFFERS_ALLOCATED(x) ((x) << 0) |
366 | +# define DMIF_BUFFERS_ALLOCATED_COMPLETED (1 << 4) |
367 | + |
368 | #define IH_RB_CNTL 0x3e00 |
369 | # define IH_RB_ENABLE (1 << 0) |
370 | # define IH_IB_SIZE(x) ((x) << 1) /* log2 */ |
371 | diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c |
372 | index dea6f63c..239a407 100644 |
373 | --- a/drivers/gpu/drm/radeon/radeon_atombios.c |
374 | +++ b/drivers/gpu/drm/radeon/radeon_atombios.c |
375 | @@ -715,13 +715,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) |
376 | (ATOM_SRC_DST_TABLE_FOR_ONE_OBJECT *) |
377 | (ctx->bios + data_offset + |
378 | le16_to_cpu(router_obj->asObjects[k].usSrcDstTableOffset)); |
379 | + u8 *num_dst_objs = (u8 *) |
380 | + ((u8 *)router_src_dst_table + 1 + |
381 | + (router_src_dst_table->ucNumberOfSrc * 2)); |
382 | + u16 *dst_objs = (u16 *)(num_dst_objs + 1); |
383 | int enum_id; |
384 | |
385 | router.router_id = router_obj_id; |
386 | - for (enum_id = 0; enum_id < router_src_dst_table->ucNumberOfDst; |
387 | - enum_id++) { |
388 | + for (enum_id = 0; enum_id < (*num_dst_objs); enum_id++) { |
389 | if (le16_to_cpu(path->usConnObjectId) == |
390 | - le16_to_cpu(router_src_dst_table->usDstObjectID[enum_id])) |
391 | + le16_to_cpu(dst_objs[enum_id])) |
392 | break; |
393 | } |
394 | |
395 | @@ -1651,7 +1654,9 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct |
396 | kfree(edid); |
397 | } |
398 | } |
399 | - record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD); |
400 | + record += fake_edid_record->ucFakeEDIDLength ? |
401 | + fake_edid_record->ucFakeEDIDLength + 2 : |
402 | + sizeof(ATOM_FAKE_EDID_PATCH_RECORD); |
403 | break; |
404 | case LCD_PANEL_RESOLUTION_RECORD_TYPE: |
405 | panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record; |
406 | diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c |
407 | index 2399f25..5a87c9f 100644 |
408 | --- a/drivers/gpu/drm/radeon/radeon_connectors.c |
409 | +++ b/drivers/gpu/drm/radeon/radeon_connectors.c |
410 | @@ -1489,6 +1489,24 @@ static const struct drm_connector_funcs radeon_dp_connector_funcs = { |
411 | .force = radeon_dvi_force, |
412 | }; |
413 | |
414 | +static const struct drm_connector_funcs radeon_edp_connector_funcs = { |
415 | + .dpms = drm_helper_connector_dpms, |
416 | + .detect = radeon_dp_detect, |
417 | + .fill_modes = drm_helper_probe_single_connector_modes, |
418 | + .set_property = radeon_lvds_set_property, |
419 | + .destroy = radeon_dp_connector_destroy, |
420 | + .force = radeon_dvi_force, |
421 | +}; |
422 | + |
423 | +static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = { |
424 | + .dpms = drm_helper_connector_dpms, |
425 | + .detect = radeon_dp_detect, |
426 | + .fill_modes = drm_helper_probe_single_connector_modes, |
427 | + .set_property = radeon_lvds_set_property, |
428 | + .destroy = radeon_dp_connector_destroy, |
429 | + .force = radeon_dvi_force, |
430 | +}; |
431 | + |
432 | void |
433 | radeon_add_atom_connector(struct drm_device *dev, |
434 | uint32_t connector_id, |
435 | @@ -1580,8 +1598,6 @@ radeon_add_atom_connector(struct drm_device *dev, |
436 | goto failed; |
437 | radeon_dig_connector->igp_lane_info = igp_lane_info; |
438 | radeon_connector->con_priv = radeon_dig_connector; |
439 | - drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type); |
440 | - drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs); |
441 | if (i2c_bus->valid) { |
442 | /* add DP i2c bus */ |
443 | if (connector_type == DRM_MODE_CONNECTOR_eDP) |
444 | @@ -1598,6 +1614,10 @@ radeon_add_atom_connector(struct drm_device *dev, |
445 | case DRM_MODE_CONNECTOR_VGA: |
446 | case DRM_MODE_CONNECTOR_DVIA: |
447 | default: |
448 | + drm_connector_init(dev, &radeon_connector->base, |
449 | + &radeon_dp_connector_funcs, connector_type); |
450 | + drm_connector_helper_add(&radeon_connector->base, |
451 | + &radeon_dp_connector_helper_funcs); |
452 | connector->interlace_allowed = true; |
453 | connector->doublescan_allowed = true; |
454 | radeon_connector->dac_load_detect = true; |
455 | @@ -1610,6 +1630,10 @@ radeon_add_atom_connector(struct drm_device *dev, |
456 | case DRM_MODE_CONNECTOR_HDMIA: |
457 | case DRM_MODE_CONNECTOR_HDMIB: |
458 | case DRM_MODE_CONNECTOR_DisplayPort: |
459 | + drm_connector_init(dev, &radeon_connector->base, |
460 | + &radeon_dp_connector_funcs, connector_type); |
461 | + drm_connector_helper_add(&radeon_connector->base, |
462 | + &radeon_dp_connector_helper_funcs); |
463 | drm_object_attach_property(&radeon_connector->base.base, |
464 | rdev->mode_info.underscan_property, |
465 | UNDERSCAN_OFF); |
466 | @@ -1634,6 +1658,10 @@ radeon_add_atom_connector(struct drm_device *dev, |
467 | break; |
468 | case DRM_MODE_CONNECTOR_LVDS: |
469 | case DRM_MODE_CONNECTOR_eDP: |
470 | + drm_connector_init(dev, &radeon_connector->base, |
471 | + &radeon_lvds_bridge_connector_funcs, connector_type); |
472 | + drm_connector_helper_add(&radeon_connector->base, |
473 | + &radeon_dp_connector_helper_funcs); |
474 | drm_object_attach_property(&radeon_connector->base.base, |
475 | dev->mode_config.scaling_mode_property, |
476 | DRM_MODE_SCALE_FULLSCREEN); |
477 | @@ -1797,7 +1825,7 @@ radeon_add_atom_connector(struct drm_device *dev, |
478 | goto failed; |
479 | radeon_dig_connector->igp_lane_info = igp_lane_info; |
480 | radeon_connector->con_priv = radeon_dig_connector; |
481 | - drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type); |
482 | + drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type); |
483 | drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs); |
484 | if (i2c_bus->valid) { |
485 | /* add DP i2c bus */ |
486 | diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c |
487 | index 7e265a5..6337f67 100644 |
488 | --- a/drivers/gpu/drm/radeon/radeon_cs.c |
489 | +++ b/drivers/gpu/drm/radeon/radeon_cs.c |
490 | @@ -80,9 +80,11 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p) |
491 | p->relocs[i].lobj.bo = p->relocs[i].robj; |
492 | p->relocs[i].lobj.written = !!r->write_domain; |
493 | |
494 | - /* the first reloc of an UVD job is the |
495 | - msg and that must be in VRAM */ |
496 | - if (p->ring == R600_RING_TYPE_UVD_INDEX && i == 0) { |
497 | + /* the first reloc of an UVD job is the msg and that must be in |
498 | + VRAM, also but everything into VRAM on AGP cards to avoid |
499 | + image corruptions */ |
500 | + if (p->ring == R600_RING_TYPE_UVD_INDEX && |
501 | + (i == 0 || p->rdev->flags & RADEON_IS_AGP)) { |
502 | /* TODO: is this still needed for NI+ ? */ |
503 | p->relocs[i].lobj.domain = |
504 | RADEON_GEM_DOMAIN_VRAM; |
505 | diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c |
506 | index 4f2d4f4..7e292d8 100644 |
507 | --- a/drivers/gpu/drm/radeon/radeon_kms.c |
508 | +++ b/drivers/gpu/drm/radeon/radeon_kms.c |
509 | @@ -414,6 +414,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) |
510 | value = rdev->config.si.tile_mode_array; |
511 | value_size = sizeof(uint32_t)*32; |
512 | break; |
513 | + case RADEON_INFO_SI_CP_DMA_COMPUTE: |
514 | + *value = 1; |
515 | + break; |
516 | default: |
517 | DRM_DEBUG_KMS("Invalid request %d\n", info->request); |
518 | return -EINVAL; |
519 | diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c |
520 | index 233a9b9..b8074a8 100644 |
521 | --- a/drivers/gpu/drm/radeon/rs400.c |
522 | +++ b/drivers/gpu/drm/radeon/rs400.c |
523 | @@ -174,10 +174,13 @@ int rs400_gart_enable(struct radeon_device *rdev) |
524 | /* FIXME: according to doc we should set HIDE_MMCFG_BAR=0, |
525 | * AGPMODE30=0 & AGP30ENHANCED=0 in NB_CNTL */ |
526 | if ((rdev->family == CHIP_RS690) || (rdev->family == CHIP_RS740)) { |
527 | - WREG32_MC(RS480_MC_MISC_CNTL, |
528 | - (RS480_GART_INDEX_REG_EN | RS690_BLOCK_GFX_D3_EN)); |
529 | + tmp = RREG32_MC(RS480_MC_MISC_CNTL); |
530 | + tmp |= RS480_GART_INDEX_REG_EN | RS690_BLOCK_GFX_D3_EN; |
531 | + WREG32_MC(RS480_MC_MISC_CNTL, tmp); |
532 | } else { |
533 | - WREG32_MC(RS480_MC_MISC_CNTL, RS480_GART_INDEX_REG_EN); |
534 | + tmp = RREG32_MC(RS480_MC_MISC_CNTL); |
535 | + tmp |= RS480_GART_INDEX_REG_EN; |
536 | + WREG32_MC(RS480_MC_MISC_CNTL, tmp); |
537 | } |
538 | /* Enable gart */ |
539 | WREG32_MC(RS480_AGP_ADDRESS_SPACE_SIZE, (RS480_GART_EN | size_reg)); |
540 | diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c |
541 | index 1a96a16..f054a3b 100644 |
542 | --- a/drivers/gpu/drm/radeon/si.c |
543 | +++ b/drivers/gpu/drm/radeon/si.c |
544 | @@ -1467,7 +1467,8 @@ static u32 dce6_line_buffer_adjust(struct radeon_device *rdev, |
545 | struct drm_display_mode *mode, |
546 | struct drm_display_mode *other_mode) |
547 | { |
548 | - u32 tmp; |
549 | + u32 tmp, buffer_alloc, i; |
550 | + u32 pipe_offset = radeon_crtc->crtc_id * 0x20; |
551 | /* |
552 | * Line Buffer Setup |
553 | * There are 3 line buffers, each one shared by 2 display controllers. |
554 | @@ -1482,16 +1483,30 @@ static u32 dce6_line_buffer_adjust(struct radeon_device *rdev, |
555 | * non-linked crtcs for maximum line buffer allocation. |
556 | */ |
557 | if (radeon_crtc->base.enabled && mode) { |
558 | - if (other_mode) |
559 | + if (other_mode) { |
560 | tmp = 0; /* 1/2 */ |
561 | - else |
562 | + buffer_alloc = 1; |
563 | + } else { |
564 | tmp = 2; /* whole */ |
565 | - } else |
566 | + buffer_alloc = 2; |
567 | + } |
568 | + } else { |
569 | tmp = 0; |
570 | + buffer_alloc = 0; |
571 | + } |
572 | |
573 | WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, |
574 | DC_LB_MEMORY_CONFIG(tmp)); |
575 | |
576 | + WREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset, |
577 | + DMIF_BUFFERS_ALLOCATED(buffer_alloc)); |
578 | + for (i = 0; i < rdev->usec_timeout; i++) { |
579 | + if (RREG32(PIPE0_DMIF_BUFFER_CONTROL + pipe_offset) & |
580 | + DMIF_BUFFERS_ALLOCATED_COMPLETED) |
581 | + break; |
582 | + udelay(1); |
583 | + } |
584 | + |
585 | if (radeon_crtc->base.enabled && mode) { |
586 | switch (tmp) { |
587 | case 0: |
588 | @@ -3796,13 +3811,64 @@ static int si_vm_packet3_ce_check(struct radeon_device *rdev, |
589 | return 0; |
590 | } |
591 | |
592 | +static int si_vm_packet3_cp_dma_check(u32 *ib, u32 idx) |
593 | +{ |
594 | + u32 start_reg, reg, i; |
595 | + u32 command = ib[idx + 4]; |
596 | + u32 info = ib[idx + 1]; |
597 | + u32 idx_value = ib[idx]; |
598 | + if (command & PACKET3_CP_DMA_CMD_SAS) { |
599 | + /* src address space is register */ |
600 | + if (((info & 0x60000000) >> 29) == 0) { |
601 | + start_reg = idx_value << 2; |
602 | + if (command & PACKET3_CP_DMA_CMD_SAIC) { |
603 | + reg = start_reg; |
604 | + if (!si_vm_reg_valid(reg)) { |
605 | + DRM_ERROR("CP DMA Bad SRC register\n"); |
606 | + return -EINVAL; |
607 | + } |
608 | + } else { |
609 | + for (i = 0; i < (command & 0x1fffff); i++) { |
610 | + reg = start_reg + (4 * i); |
611 | + if (!si_vm_reg_valid(reg)) { |
612 | + DRM_ERROR("CP DMA Bad SRC register\n"); |
613 | + return -EINVAL; |
614 | + } |
615 | + } |
616 | + } |
617 | + } |
618 | + } |
619 | + if (command & PACKET3_CP_DMA_CMD_DAS) { |
620 | + /* dst address space is register */ |
621 | + if (((info & 0x00300000) >> 20) == 0) { |
622 | + start_reg = ib[idx + 2]; |
623 | + if (command & PACKET3_CP_DMA_CMD_DAIC) { |
624 | + reg = start_reg; |
625 | + if (!si_vm_reg_valid(reg)) { |
626 | + DRM_ERROR("CP DMA Bad DST register\n"); |
627 | + return -EINVAL; |
628 | + } |
629 | + } else { |
630 | + for (i = 0; i < (command & 0x1fffff); i++) { |
631 | + reg = start_reg + (4 * i); |
632 | + if (!si_vm_reg_valid(reg)) { |
633 | + DRM_ERROR("CP DMA Bad DST register\n"); |
634 | + return -EINVAL; |
635 | + } |
636 | + } |
637 | + } |
638 | + } |
639 | + } |
640 | + return 0; |
641 | +} |
642 | + |
643 | static int si_vm_packet3_gfx_check(struct radeon_device *rdev, |
644 | u32 *ib, struct radeon_cs_packet *pkt) |
645 | { |
646 | + int r; |
647 | u32 idx = pkt->idx + 1; |
648 | u32 idx_value = ib[idx]; |
649 | u32 start_reg, end_reg, reg, i; |
650 | - u32 command, info; |
651 | |
652 | switch (pkt->opcode) { |
653 | case PACKET3_NOP: |
654 | @@ -3903,50 +3969,9 @@ static int si_vm_packet3_gfx_check(struct radeon_device *rdev, |
655 | } |
656 | break; |
657 | case PACKET3_CP_DMA: |
658 | - command = ib[idx + 4]; |
659 | - info = ib[idx + 1]; |
660 | - if (command & PACKET3_CP_DMA_CMD_SAS) { |
661 | - /* src address space is register */ |
662 | - if (((info & 0x60000000) >> 29) == 0) { |
663 | - start_reg = idx_value << 2; |
664 | - if (command & PACKET3_CP_DMA_CMD_SAIC) { |
665 | - reg = start_reg; |
666 | - if (!si_vm_reg_valid(reg)) { |
667 | - DRM_ERROR("CP DMA Bad SRC register\n"); |
668 | - return -EINVAL; |
669 | - } |
670 | - } else { |
671 | - for (i = 0; i < (command & 0x1fffff); i++) { |
672 | - reg = start_reg + (4 * i); |
673 | - if (!si_vm_reg_valid(reg)) { |
674 | - DRM_ERROR("CP DMA Bad SRC register\n"); |
675 | - return -EINVAL; |
676 | - } |
677 | - } |
678 | - } |
679 | - } |
680 | - } |
681 | - if (command & PACKET3_CP_DMA_CMD_DAS) { |
682 | - /* dst address space is register */ |
683 | - if (((info & 0x00300000) >> 20) == 0) { |
684 | - start_reg = ib[idx + 2]; |
685 | - if (command & PACKET3_CP_DMA_CMD_DAIC) { |
686 | - reg = start_reg; |
687 | - if (!si_vm_reg_valid(reg)) { |
688 | - DRM_ERROR("CP DMA Bad DST register\n"); |
689 | - return -EINVAL; |
690 | - } |
691 | - } else { |
692 | - for (i = 0; i < (command & 0x1fffff); i++) { |
693 | - reg = start_reg + (4 * i); |
694 | - if (!si_vm_reg_valid(reg)) { |
695 | - DRM_ERROR("CP DMA Bad DST register\n"); |
696 | - return -EINVAL; |
697 | - } |
698 | - } |
699 | - } |
700 | - } |
701 | - } |
702 | + r = si_vm_packet3_cp_dma_check(ib, idx); |
703 | + if (r) |
704 | + return r; |
705 | break; |
706 | default: |
707 | DRM_ERROR("Invalid GFX packet3: 0x%x\n", pkt->opcode); |
708 | @@ -3958,6 +3983,7 @@ static int si_vm_packet3_gfx_check(struct radeon_device *rdev, |
709 | static int si_vm_packet3_compute_check(struct radeon_device *rdev, |
710 | u32 *ib, struct radeon_cs_packet *pkt) |
711 | { |
712 | + int r; |
713 | u32 idx = pkt->idx + 1; |
714 | u32 idx_value = ib[idx]; |
715 | u32 start_reg, reg, i; |
716 | @@ -4030,6 +4056,11 @@ static int si_vm_packet3_compute_check(struct radeon_device *rdev, |
717 | return -EINVAL; |
718 | } |
719 | break; |
720 | + case PACKET3_CP_DMA: |
721 | + r = si_vm_packet3_cp_dma_check(ib, idx); |
722 | + if (r) |
723 | + return r; |
724 | + break; |
725 | default: |
726 | DRM_ERROR("Invalid Compute packet3: 0x%x\n", pkt->opcode); |
727 | return -EINVAL; |
728 | diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h |
729 | index 8f2d7d4..8c68e67 100644 |
730 | --- a/drivers/gpu/drm/radeon/sid.h |
731 | +++ b/drivers/gpu/drm/radeon/sid.h |
732 | @@ -97,6 +97,10 @@ |
733 | |
734 | #define DMIF_ADDR_CALC 0xC00 |
735 | |
736 | +#define PIPE0_DMIF_BUFFER_CONTROL 0x0ca0 |
737 | +# define DMIF_BUFFERS_ALLOCATED(x) ((x) << 0) |
738 | +# define DMIF_BUFFERS_ALLOCATED_COMPLETED (1 << 4) |
739 | + |
740 | #define SRBM_STATUS 0xE50 |
741 | #define GRBM_RQ_PENDING (1 << 5) |
742 | #define VMC_BUSY (1 << 8) |
743 | diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c |
744 | index 5e93a52..210d503 100644 |
745 | --- a/drivers/gpu/drm/ttm/ttm_tt.c |
746 | +++ b/drivers/gpu/drm/ttm/ttm_tt.c |
747 | @@ -170,7 +170,7 @@ void ttm_tt_destroy(struct ttm_tt *ttm) |
748 | ttm_tt_unbind(ttm); |
749 | } |
750 | |
751 | - if (likely(ttm->pages != NULL)) { |
752 | + if (ttm->state == tt_unbound) { |
753 | ttm->bdev->driver->ttm_tt_unpopulate(ttm); |
754 | } |
755 | |
756 | diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
757 | index ed626e0..ca959cf 100644 |
758 | --- a/drivers/hid/hid-core.c |
759 | +++ b/drivers/hid/hid-core.c |
760 | @@ -94,7 +94,6 @@ EXPORT_SYMBOL_GPL(hid_register_report); |
761 | static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values) |
762 | { |
763 | struct hid_field *field; |
764 | - int i; |
765 | |
766 | if (report->maxfield == HID_MAX_FIELDS) { |
767 | hid_err(report->device, "too many fields in report\n"); |
768 | @@ -113,9 +112,6 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned |
769 | field->value = (s32 *)(field->usage + usages); |
770 | field->report = report; |
771 | |
772 | - for (i = 0; i < usages; i++) |
773 | - field->usage[i].usage_index = i; |
774 | - |
775 | return field; |
776 | } |
777 | |
778 | @@ -226,9 +222,9 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign |
779 | { |
780 | struct hid_report *report; |
781 | struct hid_field *field; |
782 | - int usages; |
783 | + unsigned usages; |
784 | unsigned offset; |
785 | - int i; |
786 | + unsigned i; |
787 | |
788 | report = hid_register_report(parser->device, report_type, parser->global.report_id); |
789 | if (!report) { |
790 | @@ -255,7 +251,8 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign |
791 | if (!parser->local.usage_index) /* Ignore padding fields */ |
792 | return 0; |
793 | |
794 | - usages = max_t(int, parser->local.usage_index, parser->global.report_count); |
795 | + usages = max_t(unsigned, parser->local.usage_index, |
796 | + parser->global.report_count); |
797 | |
798 | field = hid_register_field(report, usages, parser->global.report_count); |
799 | if (!field) |
800 | @@ -266,13 +263,14 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign |
801 | field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION); |
802 | |
803 | for (i = 0; i < usages; i++) { |
804 | - int j = i; |
805 | + unsigned j = i; |
806 | /* Duplicate the last usage we parsed if we have excess values */ |
807 | if (i >= parser->local.usage_index) |
808 | j = parser->local.usage_index - 1; |
809 | field->usage[i].hid = parser->local.usage[j]; |
810 | field->usage[i].collection_index = |
811 | parser->local.collection_index[j]; |
812 | + field->usage[i].usage_index = i; |
813 | } |
814 | |
815 | field->maxusage = usages; |
816 | @@ -759,6 +757,64 @@ int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size) |
817 | } |
818 | EXPORT_SYMBOL_GPL(hid_parse_report); |
819 | |
820 | +static const char * const hid_report_names[] = { |
821 | + "HID_INPUT_REPORT", |
822 | + "HID_OUTPUT_REPORT", |
823 | + "HID_FEATURE_REPORT", |
824 | +}; |
825 | +/** |
826 | + * hid_validate_values - validate existing device report's value indexes |
827 | + * |
828 | + * @device: hid device |
829 | + * @type: which report type to examine |
830 | + * @id: which report ID to examine (0 for first) |
831 | + * @field_index: which report field to examine |
832 | + * @report_counts: expected number of values |
833 | + * |
834 | + * Validate the number of values in a given field of a given report, after |
835 | + * parsing. |
836 | + */ |
837 | +struct hid_report *hid_validate_values(struct hid_device *hid, |
838 | + unsigned int type, unsigned int id, |
839 | + unsigned int field_index, |
840 | + unsigned int report_counts) |
841 | +{ |
842 | + struct hid_report *report; |
843 | + |
844 | + if (type > HID_FEATURE_REPORT) { |
845 | + hid_err(hid, "invalid HID report type %u\n", type); |
846 | + return NULL; |
847 | + } |
848 | + |
849 | + if (id >= HID_MAX_IDS) { |
850 | + hid_err(hid, "invalid HID report id %u\n", id); |
851 | + return NULL; |
852 | + } |
853 | + |
854 | + /* |
855 | + * Explicitly not using hid_get_report() here since it depends on |
856 | + * ->numbered being checked, which may not always be the case when |
857 | + * drivers go to access report values. |
858 | + */ |
859 | + report = hid->report_enum[type].report_id_hash[id]; |
860 | + if (!report) { |
861 | + hid_err(hid, "missing %s %u\n", hid_report_names[type], id); |
862 | + return NULL; |
863 | + } |
864 | + if (report->maxfield <= field_index) { |
865 | + hid_err(hid, "not enough fields in %s %u\n", |
866 | + hid_report_names[type], id); |
867 | + return NULL; |
868 | + } |
869 | + if (report->field[field_index]->report_count < report_counts) { |
870 | + hid_err(hid, "not enough values in %s %u field %u\n", |
871 | + hid_report_names[type], id, field_index); |
872 | + return NULL; |
873 | + } |
874 | + return report; |
875 | +} |
876 | +EXPORT_SYMBOL_GPL(hid_validate_values); |
877 | + |
878 | /** |
879 | * hid_open_report - open a driver-specific device report |
880 | * |
881 | @@ -1237,7 +1293,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size, |
882 | goto out; |
883 | } |
884 | |
885 | - if (hid->claimed != HID_CLAIMED_HIDRAW) { |
886 | + if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) { |
887 | for (a = 0; a < report->maxfield; a++) |
888 | hid_input_field(hid, report->field[a], cdata, interrupt); |
889 | hdrv = hid->driver; |
890 | diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c |
891 | index ac5e935..012880a 100644 |
892 | --- a/drivers/hid/hid-input.c |
893 | +++ b/drivers/hid/hid-input.c |
894 | @@ -485,6 +485,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel |
895 | if (field->flags & HID_MAIN_ITEM_CONSTANT) |
896 | goto ignore; |
897 | |
898 | + /* Ignore if report count is out of bounds. */ |
899 | + if (field->report_count < 1) |
900 | + goto ignore; |
901 | + |
902 | /* only LED usages are supported in output fields */ |
903 | if (field->report_type == HID_OUTPUT_REPORT && |
904 | (usage->hid & HID_USAGE_PAGE) != HID_UP_LED) { |
905 | @@ -1163,7 +1167,11 @@ static void report_features(struct hid_device *hid) |
906 | |
907 | rep_enum = &hid->report_enum[HID_FEATURE_REPORT]; |
908 | list_for_each_entry(rep, &rep_enum->report_list, list) |
909 | - for (i = 0; i < rep->maxfield; i++) |
910 | + for (i = 0; i < rep->maxfield; i++) { |
911 | + /* Ignore if report count is out of bounds. */ |
912 | + if (rep->field[i]->report_count < 1) |
913 | + continue; |
914 | + |
915 | for (j = 0; j < rep->field[i]->maxusage; j++) { |
916 | /* Verify if Battery Strength feature is available */ |
917 | hidinput_setup_battery(hid, HID_FEATURE_REPORT, rep->field[i]); |
918 | @@ -1172,6 +1180,7 @@ static void report_features(struct hid_device *hid) |
919 | drv->feature_mapping(hid, rep->field[i], |
920 | rep->field[i]->usage + j); |
921 | } |
922 | + } |
923 | } |
924 | |
925 | static struct hid_input *hidinput_allocate(struct hid_device *hid) |
926 | diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c |
927 | index 07837f5..31cf29a 100644 |
928 | --- a/drivers/hid/hid-lenovo-tpkbd.c |
929 | +++ b/drivers/hid/hid-lenovo-tpkbd.c |
930 | @@ -339,7 +339,15 @@ static int tpkbd_probe_tp(struct hid_device *hdev) |
931 | struct tpkbd_data_pointer *data_pointer; |
932 | size_t name_sz = strlen(dev_name(dev)) + 16; |
933 | char *name_mute, *name_micmute; |
934 | - int ret; |
935 | + int i, ret; |
936 | + |
937 | + /* Validate required reports. */ |
938 | + for (i = 0; i < 4; i++) { |
939 | + if (!hid_validate_values(hdev, HID_FEATURE_REPORT, 4, i, 1)) |
940 | + return -ENODEV; |
941 | + } |
942 | + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 3, 0, 2)) |
943 | + return -ENODEV; |
944 | |
945 | if (sysfs_create_group(&hdev->dev.kobj, |
946 | &tpkbd_attr_group_pointer)) { |
947 | @@ -406,22 +414,27 @@ static int tpkbd_probe(struct hid_device *hdev, |
948 | ret = hid_parse(hdev); |
949 | if (ret) { |
950 | hid_err(hdev, "hid_parse failed\n"); |
951 | - goto err_free; |
952 | + goto err; |
953 | } |
954 | |
955 | ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); |
956 | if (ret) { |
957 | hid_err(hdev, "hid_hw_start failed\n"); |
958 | - goto err_free; |
959 | + goto err; |
960 | } |
961 | |
962 | uhdev = (struct usbhid_device *) hdev->driver_data; |
963 | |
964 | - if (uhdev->ifnum == 1) |
965 | - return tpkbd_probe_tp(hdev); |
966 | + if (uhdev->ifnum == 1) { |
967 | + ret = tpkbd_probe_tp(hdev); |
968 | + if (ret) |
969 | + goto err_hid; |
970 | + } |
971 | |
972 | return 0; |
973 | -err_free: |
974 | +err_hid: |
975 | + hid_hw_stop(hdev); |
976 | +err: |
977 | return ret; |
978 | } |
979 | |
980 | diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c |
981 | index b3cd150..1a42eaa 100644 |
982 | --- a/drivers/hid/hid-lg2ff.c |
983 | +++ b/drivers/hid/hid-lg2ff.c |
984 | @@ -64,26 +64,13 @@ int lg2ff_init(struct hid_device *hid) |
985 | struct hid_report *report; |
986 | struct hid_input *hidinput = list_entry(hid->inputs.next, |
987 | struct hid_input, list); |
988 | - struct list_head *report_list = |
989 | - &hid->report_enum[HID_OUTPUT_REPORT].report_list; |
990 | struct input_dev *dev = hidinput->input; |
991 | int error; |
992 | |
993 | - if (list_empty(report_list)) { |
994 | - hid_err(hid, "no output report found\n"); |
995 | + /* Check that the report looks ok */ |
996 | + report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7); |
997 | + if (!report) |
998 | return -ENODEV; |
999 | - } |
1000 | - |
1001 | - report = list_entry(report_list->next, struct hid_report, list); |
1002 | - |
1003 | - if (report->maxfield < 1) { |
1004 | - hid_err(hid, "output report is empty\n"); |
1005 | - return -ENODEV; |
1006 | - } |
1007 | - if (report->field[0]->report_count < 7) { |
1008 | - hid_err(hid, "not enough values in the field\n"); |
1009 | - return -ENODEV; |
1010 | - } |
1011 | |
1012 | lg2ff = kmalloc(sizeof(struct lg2ff_device), GFP_KERNEL); |
1013 | if (!lg2ff) |
1014 | diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c |
1015 | index e52f181..8c2da18 100644 |
1016 | --- a/drivers/hid/hid-lg3ff.c |
1017 | +++ b/drivers/hid/hid-lg3ff.c |
1018 | @@ -66,10 +66,11 @@ static int hid_lg3ff_play(struct input_dev *dev, void *data, |
1019 | int x, y; |
1020 | |
1021 | /* |
1022 | - * Maxusage should always be 63 (maximum fields) |
1023 | - * likely a better way to ensure this data is clean |
1024 | + * Available values in the field should always be 63, but we only use up to |
1025 | + * 35. Instead, clear the entire area, however big it is. |
1026 | */ |
1027 | - memset(report->field[0]->value, 0, sizeof(__s32)*report->field[0]->maxusage); |
1028 | + memset(report->field[0]->value, 0, |
1029 | + sizeof(__s32) * report->field[0]->report_count); |
1030 | |
1031 | switch (effect->type) { |
1032 | case FF_CONSTANT: |
1033 | @@ -129,32 +130,14 @@ static const signed short ff3_joystick_ac[] = { |
1034 | int lg3ff_init(struct hid_device *hid) |
1035 | { |
1036 | struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); |
1037 | - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; |
1038 | struct input_dev *dev = hidinput->input; |
1039 | - struct hid_report *report; |
1040 | - struct hid_field *field; |
1041 | const signed short *ff_bits = ff3_joystick_ac; |
1042 | int error; |
1043 | int i; |
1044 | |
1045 | - /* Find the report to use */ |
1046 | - if (list_empty(report_list)) { |
1047 | - hid_err(hid, "No output report found\n"); |
1048 | - return -1; |
1049 | - } |
1050 | - |
1051 | /* Check that the report looks ok */ |
1052 | - report = list_entry(report_list->next, struct hid_report, list); |
1053 | - if (!report) { |
1054 | - hid_err(hid, "NULL output report\n"); |
1055 | - return -1; |
1056 | - } |
1057 | - |
1058 | - field = report->field[0]; |
1059 | - if (!field) { |
1060 | - hid_err(hid, "NULL field\n"); |
1061 | - return -1; |
1062 | - } |
1063 | + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35)) |
1064 | + return -ENODEV; |
1065 | |
1066 | /* Assume single fixed device G940 */ |
1067 | for (i = 0; ff_bits[i] >= 0; i++) |
1068 | diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c |
1069 | index 0ddae2a..8782fe1 100644 |
1070 | --- a/drivers/hid/hid-lg4ff.c |
1071 | +++ b/drivers/hid/hid-lg4ff.c |
1072 | @@ -484,34 +484,16 @@ static enum led_brightness lg4ff_led_get_brightness(struct led_classdev *led_cde |
1073 | int lg4ff_init(struct hid_device *hid) |
1074 | { |
1075 | struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); |
1076 | - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; |
1077 | struct input_dev *dev = hidinput->input; |
1078 | - struct hid_report *report; |
1079 | - struct hid_field *field; |
1080 | struct lg4ff_device_entry *entry; |
1081 | struct lg_drv_data *drv_data; |
1082 | struct usb_device_descriptor *udesc; |
1083 | int error, i, j; |
1084 | __u16 bcdDevice, rev_maj, rev_min; |
1085 | |
1086 | - /* Find the report to use */ |
1087 | - if (list_empty(report_list)) { |
1088 | - hid_err(hid, "No output report found\n"); |
1089 | - return -1; |
1090 | - } |
1091 | - |
1092 | /* Check that the report looks ok */ |
1093 | - report = list_entry(report_list->next, struct hid_report, list); |
1094 | - if (!report) { |
1095 | - hid_err(hid, "NULL output report\n"); |
1096 | + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) |
1097 | return -1; |
1098 | - } |
1099 | - |
1100 | - field = report->field[0]; |
1101 | - if (!field) { |
1102 | - hid_err(hid, "NULL field\n"); |
1103 | - return -1; |
1104 | - } |
1105 | |
1106 | /* Check what wheel has been connected */ |
1107 | for (i = 0; i < ARRAY_SIZE(lg4ff_devices); i++) { |
1108 | diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c |
1109 | index d7ea8c8..e1394af 100644 |
1110 | --- a/drivers/hid/hid-lgff.c |
1111 | +++ b/drivers/hid/hid-lgff.c |
1112 | @@ -128,27 +128,14 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude) |
1113 | int lgff_init(struct hid_device* hid) |
1114 | { |
1115 | struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); |
1116 | - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; |
1117 | struct input_dev *dev = hidinput->input; |
1118 | - struct hid_report *report; |
1119 | - struct hid_field *field; |
1120 | const signed short *ff_bits = ff_joystick; |
1121 | int error; |
1122 | int i; |
1123 | |
1124 | - /* Find the report to use */ |
1125 | - if (list_empty(report_list)) { |
1126 | - hid_err(hid, "No output report found\n"); |
1127 | - return -1; |
1128 | - } |
1129 | - |
1130 | /* Check that the report looks ok */ |
1131 | - report = list_entry(report_list->next, struct hid_report, list); |
1132 | - field = report->field[0]; |
1133 | - if (!field) { |
1134 | - hid_err(hid, "NULL field\n"); |
1135 | - return -1; |
1136 | - } |
1137 | + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) |
1138 | + return -ENODEV; |
1139 | |
1140 | for (i = 0; i < ARRAY_SIZE(devices); i++) { |
1141 | if (dev->id.vendor == devices[i].idVendor && |
1142 | diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c |
1143 | index 5207591a..0522b80 100644 |
1144 | --- a/drivers/hid/hid-logitech-dj.c |
1145 | +++ b/drivers/hid/hid-logitech-dj.c |
1146 | @@ -421,7 +421,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev, |
1147 | struct hid_report *report; |
1148 | struct hid_report_enum *output_report_enum; |
1149 | u8 *data = (u8 *)(&dj_report->device_index); |
1150 | - int i; |
1151 | + unsigned int i; |
1152 | |
1153 | output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT]; |
1154 | report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT]; |
1155 | @@ -431,7 +431,7 @@ static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev, |
1156 | return -ENODEV; |
1157 | } |
1158 | |
1159 | - for (i = 0; i < report->field[0]->report_count; i++) |
1160 | + for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++) |
1161 | report->field[0]->value[i] = data[i]; |
1162 | |
1163 | hid_hw_request(hdev, report, HID_REQ_SET_REPORT); |
1164 | @@ -738,6 +738,12 @@ static int logi_dj_probe(struct hid_device *hdev, |
1165 | goto hid_parse_fail; |
1166 | } |
1167 | |
1168 | + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT, |
1169 | + 0, DJREPORT_SHORT_LENGTH - 1)) { |
1170 | + retval = -ENODEV; |
1171 | + goto hid_parse_fail; |
1172 | + } |
1173 | + |
1174 | /* Starts the usb device and connects to upper interfaces hiddev and |
1175 | * hidraw */ |
1176 | retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT); |
1177 | diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c |
1178 | index d39a5ce..b6701ce 100644 |
1179 | --- a/drivers/hid/hid-multitouch.c |
1180 | +++ b/drivers/hid/hid-multitouch.c |
1181 | @@ -101,9 +101,9 @@ struct mt_device { |
1182 | unsigned last_slot_field; /* the last field of a slot */ |
1183 | unsigned mt_report_id; /* the report ID of the multitouch device */ |
1184 | unsigned pen_report_id; /* the report ID of the pen device */ |
1185 | - __s8 inputmode; /* InputMode HID feature, -1 if non-existent */ |
1186 | - __s8 inputmode_index; /* InputMode HID feature index in the report */ |
1187 | - __s8 maxcontact_report_id; /* Maximum Contact Number HID feature, |
1188 | + __s16 inputmode; /* InputMode HID feature, -1 if non-existent */ |
1189 | + __s16 inputmode_index; /* InputMode HID feature index in the report */ |
1190 | + __s16 maxcontact_report_id; /* Maximum Contact Number HID feature, |
1191 | -1 if non-existent */ |
1192 | __u8 num_received; /* how many contacts we received */ |
1193 | __u8 num_expected; /* expected last contact index */ |
1194 | @@ -317,20 +317,18 @@ static void mt_feature_mapping(struct hid_device *hdev, |
1195 | struct hid_field *field, struct hid_usage *usage) |
1196 | { |
1197 | struct mt_device *td = hid_get_drvdata(hdev); |
1198 | - int i; |
1199 | |
1200 | switch (usage->hid) { |
1201 | case HID_DG_INPUTMODE: |
1202 | - td->inputmode = field->report->id; |
1203 | - td->inputmode_index = 0; /* has to be updated below */ |
1204 | - |
1205 | - for (i=0; i < field->maxusage; i++) { |
1206 | - if (field->usage[i].hid == usage->hid) { |
1207 | - td->inputmode_index = i; |
1208 | - break; |
1209 | - } |
1210 | + /* Ignore if value index is out of bounds. */ |
1211 | + if (usage->usage_index >= field->report_count) { |
1212 | + dev_err(&hdev->dev, "HID_DG_INPUTMODE out of range\n"); |
1213 | + break; |
1214 | } |
1215 | |
1216 | + td->inputmode = field->report->id; |
1217 | + td->inputmode_index = usage->usage_index; |
1218 | + |
1219 | break; |
1220 | case HID_DG_CONTACTMAX: |
1221 | td->maxcontact_report_id = field->report->id; |
1222 | @@ -536,6 +534,10 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, |
1223 | mt_store_field(usage, td, hi); |
1224 | return 1; |
1225 | case HID_DG_CONTACTCOUNT: |
1226 | + /* Ignore if indexes are out of bounds. */ |
1227 | + if (field->index >= field->report->maxfield || |
1228 | + usage->usage_index >= field->report_count) |
1229 | + return 1; |
1230 | td->cc_index = field->index; |
1231 | td->cc_value_index = usage->usage_index; |
1232 | return 1; |
1233 | diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c |
1234 | index d164911..29f328f 100644 |
1235 | --- a/drivers/hid/hid-steelseries.c |
1236 | +++ b/drivers/hid/hid-steelseries.c |
1237 | @@ -249,6 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev, |
1238 | goto err_free; |
1239 | } |
1240 | |
1241 | + if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) { |
1242 | + ret = -ENODEV; |
1243 | + goto err_free; |
1244 | + } |
1245 | + |
1246 | ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); |
1247 | if (ret) { |
1248 | hid_err(hdev, "hw start failed\n"); |
1249 | diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c |
1250 | index 6ec28a3..a29756c 100644 |
1251 | --- a/drivers/hid/hid-zpff.c |
1252 | +++ b/drivers/hid/hid-zpff.c |
1253 | @@ -68,21 +68,13 @@ static int zpff_init(struct hid_device *hid) |
1254 | struct hid_report *report; |
1255 | struct hid_input *hidinput = list_entry(hid->inputs.next, |
1256 | struct hid_input, list); |
1257 | - struct list_head *report_list = |
1258 | - &hid->report_enum[HID_OUTPUT_REPORT].report_list; |
1259 | struct input_dev *dev = hidinput->input; |
1260 | - int error; |
1261 | + int i, error; |
1262 | |
1263 | - if (list_empty(report_list)) { |
1264 | - hid_err(hid, "no output report found\n"); |
1265 | - return -ENODEV; |
1266 | - } |
1267 | - |
1268 | - report = list_entry(report_list->next, struct hid_report, list); |
1269 | - |
1270 | - if (report->maxfield < 4) { |
1271 | - hid_err(hid, "not enough fields in report\n"); |
1272 | - return -ENODEV; |
1273 | + for (i = 0; i < 4; i++) { |
1274 | + report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1); |
1275 | + if (!report) |
1276 | + return -ENODEV; |
1277 | } |
1278 | |
1279 | zpff = kzalloc(sizeof(struct zpff_device), GFP_KERNEL); |
1280 | diff --git a/drivers/media/pci/Kconfig b/drivers/media/pci/Kconfig |
1281 | index d4e2ed3..53196f1 100644 |
1282 | --- a/drivers/media/pci/Kconfig |
1283 | +++ b/drivers/media/pci/Kconfig |
1284 | @@ -1,6 +1,7 @@ |
1285 | +if PCI && MEDIA_SUPPORT |
1286 | + |
1287 | menuconfig MEDIA_PCI_SUPPORT |
1288 | bool "Media PCI Adapters" |
1289 | - depends on PCI && MEDIA_SUPPORT |
1290 | help |
1291 | Enable media drivers for PCI/PCIe bus. |
1292 | If you have such devices, say Y. |
1293 | @@ -45,3 +46,4 @@ source "drivers/media/pci/ddbridge/Kconfig" |
1294 | endif |
1295 | |
1296 | endif #MEDIA_PCI_SUPPORT |
1297 | +endif #PCI |
1298 | diff --git a/drivers/media/usb/Kconfig b/drivers/media/usb/Kconfig |
1299 | index 0a7d520..7cac453 100644 |
1300 | --- a/drivers/media/usb/Kconfig |
1301 | +++ b/drivers/media/usb/Kconfig |
1302 | @@ -1,6 +1,7 @@ |
1303 | +if USB && MEDIA_SUPPORT |
1304 | + |
1305 | menuconfig MEDIA_USB_SUPPORT |
1306 | bool "Media USB Adapters" |
1307 | - depends on USB && MEDIA_SUPPORT |
1308 | help |
1309 | Enable media drivers for USB bus. |
1310 | If you have such devices, say Y. |
1311 | @@ -52,3 +53,4 @@ source "drivers/media/usb/em28xx/Kconfig" |
1312 | endif |
1313 | |
1314 | endif #MEDIA_USB_SUPPORT |
1315 | +endif #USB |
1316 | diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c |
1317 | index eec0af4..1c6bc96 100644 |
1318 | --- a/drivers/net/ethernet/broadcom/bgmac.c |
1319 | +++ b/drivers/net/ethernet/broadcom/bgmac.c |
1320 | @@ -908,7 +908,7 @@ static void bgmac_chip_reset(struct bgmac *bgmac) |
1321 | struct bcma_drv_cc *cc = &bgmac->core->bus->drv_cc; |
1322 | u8 et_swtype = 0; |
1323 | u8 sw_type = BGMAC_CHIPCTL_1_SW_TYPE_EPHY | |
1324 | - BGMAC_CHIPCTL_1_IF_TYPE_RMII; |
1325 | + BGMAC_CHIPCTL_1_IF_TYPE_MII; |
1326 | char buf[2]; |
1327 | |
1328 | if (bcm47xx_nvram_getenv("et_swtype", buf, 1) > 0) { |
1329 | diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h |
1330 | index 98d4b5f..12a35cf 100644 |
1331 | --- a/drivers/net/ethernet/broadcom/bgmac.h |
1332 | +++ b/drivers/net/ethernet/broadcom/bgmac.h |
1333 | @@ -333,7 +333,7 @@ |
1334 | |
1335 | #define BGMAC_CHIPCTL_1_IF_TYPE_MASK 0x00000030 |
1336 | #define BGMAC_CHIPCTL_1_IF_TYPE_RMII 0x00000000 |
1337 | -#define BGMAC_CHIPCTL_1_IF_TYPE_MI 0x00000010 |
1338 | +#define BGMAC_CHIPCTL_1_IF_TYPE_MII 0x00000010 |
1339 | #define BGMAC_CHIPCTL_1_IF_TYPE_RGMII 0x00000020 |
1340 | #define BGMAC_CHIPCTL_1_SW_TYPE_MASK 0x000000C0 |
1341 | #define BGMAC_CHIPCTL_1_SW_TYPE_EPHY 0x00000000 |
1342 | diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c |
1343 | index 04ee044..b1897c7 100644 |
1344 | --- a/drivers/net/usb/cdc_ether.c |
1345 | +++ b/drivers/net/usb/cdc_ether.c |
1346 | @@ -709,6 +709,11 @@ static const struct usb_device_id products [] = { |
1347 | .bInterfaceProtocol = USB_CDC_PROTO_NONE, |
1348 | .driver_info = (unsigned long)&wwan_info, |
1349 | }, { |
1350 | + /* Telit modules */ |
1351 | + USB_VENDOR_AND_INTERFACE_INFO(0x1bc7, USB_CLASS_COMM, |
1352 | + USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), |
1353 | + .driver_info = (kernel_ulong_t) &wwan_info, |
1354 | +}, { |
1355 | USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, |
1356 | USB_CDC_PROTO_NONE), |
1357 | .driver_info = (unsigned long) &cdc_info, |
1358 | diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c |
1359 | index 7e66a90..f281971 100644 |
1360 | --- a/drivers/net/wireless/rt2x00/rt2800lib.c |
1361 | +++ b/drivers/net/wireless/rt2x00/rt2800lib.c |
1362 | @@ -2767,6 +2767,13 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev) |
1363 | int i; |
1364 | |
1365 | /* |
1366 | + * First check if temperature compensation is supported. |
1367 | + */ |
1368 | + rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom); |
1369 | + if (!rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_EXTERNAL_TX_ALC)) |
1370 | + return 0; |
1371 | + |
1372 | + /* |
1373 | * Read TSSI boundaries for temperature compensation from |
1374 | * the EEPROM. |
1375 | * |
1376 | @@ -4041,10 +4048,6 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev) |
1377 | u8 reg_id; |
1378 | u8 value; |
1379 | |
1380 | - if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) || |
1381 | - rt2800_wait_bbp_ready(rt2x00dev))) |
1382 | - return -EACCES; |
1383 | - |
1384 | if (rt2x00_rt(rt2x00dev, RT5592)) { |
1385 | rt2800_init_bbp_5592(rt2x00dev); |
1386 | return 0; |
1387 | @@ -5185,20 +5188,23 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev) |
1388 | rt2800_init_registers(rt2x00dev))) |
1389 | return -EIO; |
1390 | |
1391 | + if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev))) |
1392 | + return -EIO; |
1393 | + |
1394 | /* |
1395 | * Send signal to firmware during boot time. |
1396 | */ |
1397 | rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0); |
1398 | rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0); |
1399 | - if (rt2x00_is_usb(rt2x00dev)) { |
1400 | + if (rt2x00_is_usb(rt2x00dev)) |
1401 | rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0); |
1402 | - rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0); |
1403 | - } |
1404 | + rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0); |
1405 | msleep(1); |
1406 | |
1407 | - if (unlikely(rt2800_init_bbp(rt2x00dev))) |
1408 | + if (unlikely(rt2800_wait_bbp_ready(rt2x00dev))) |
1409 | return -EIO; |
1410 | |
1411 | + rt2800_init_bbp(rt2x00dev); |
1412 | rt2800_init_rfcsr(rt2x00dev); |
1413 | |
1414 | if (rt2x00_is_usb(rt2x00dev) && |
1415 | diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c |
1416 | index 336b3f9..0eab3a3 100644 |
1417 | --- a/drivers/pci/pci-acpi.c |
1418 | +++ b/drivers/pci/pci-acpi.c |
1419 | @@ -47,6 +47,9 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context) |
1420 | if (event != ACPI_NOTIFY_DEVICE_WAKE || !pci_dev) |
1421 | return; |
1422 | |
1423 | + if (pci_dev->pme_poll) |
1424 | + pci_dev->pme_poll = false; |
1425 | + |
1426 | if (pci_dev->current_state == PCI_D3cold) { |
1427 | pci_wakeup_event(pci_dev); |
1428 | pm_runtime_resume(&pci_dev->dev); |
1429 | @@ -57,9 +60,6 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context) |
1430 | if (pci_dev->pme_support) |
1431 | pci_check_pme_status(pci_dev); |
1432 | |
1433 | - if (pci_dev->pme_poll) |
1434 | - pci_dev->pme_poll = false; |
1435 | - |
1436 | pci_wakeup_event(pci_dev); |
1437 | pm_runtime_resume(&pci_dev->dev); |
1438 | |
1439 | diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c |
1440 | index c588e8e..ac0e79e 100644 |
1441 | --- a/drivers/usb/gadget/dummy_hcd.c |
1442 | +++ b/drivers/usb/gadget/dummy_hcd.c |
1443 | @@ -923,8 +923,9 @@ static int dummy_udc_stop(struct usb_gadget *g, |
1444 | struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); |
1445 | struct dummy *dum = dum_hcd->dum; |
1446 | |
1447 | - dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n", |
1448 | - driver->driver.name); |
1449 | + if (driver) |
1450 | + dev_dbg(udc_dev(dum), "unregister gadget driver '%s'\n", |
1451 | + driver->driver.name); |
1452 | |
1453 | dum->driver = NULL; |
1454 | |
1455 | @@ -1000,8 +1001,8 @@ static int dummy_udc_remove(struct platform_device *pdev) |
1456 | { |
1457 | struct dummy *dum = platform_get_drvdata(pdev); |
1458 | |
1459 | - usb_del_gadget_udc(&dum->gadget); |
1460 | device_remove_file(&dum->gadget.dev, &dev_attr_function); |
1461 | + usb_del_gadget_udc(&dum->gadget); |
1462 | return 0; |
1463 | } |
1464 | |
1465 | diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c |
1466 | index 8fb4291..45e944f 100644 |
1467 | --- a/fs/bio-integrity.c |
1468 | +++ b/fs/bio-integrity.c |
1469 | @@ -734,7 +734,7 @@ void bioset_integrity_free(struct bio_set *bs) |
1470 | mempool_destroy(bs->bio_integrity_pool); |
1471 | |
1472 | if (bs->bvec_integrity_pool) |
1473 | - mempool_destroy(bs->bio_integrity_pool); |
1474 | + mempool_destroy(bs->bvec_integrity_pool); |
1475 | } |
1476 | EXPORT_SYMBOL(bioset_integrity_free); |
1477 | |
1478 | diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c |
1479 | index 5699b50..0c2425b 100644 |
1480 | --- a/fs/cifs/dir.c |
1481 | +++ b/fs/cifs/dir.c |
1482 | @@ -491,6 +491,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, |
1483 | if (server->ops->close) |
1484 | server->ops->close(xid, tcon, &fid); |
1485 | cifs_del_pending_open(&open); |
1486 | + fput(file); |
1487 | rc = -ENOMEM; |
1488 | } |
1489 | |
1490 | diff --git a/fs/udf/super.c b/fs/udf/super.c |
1491 | index 9ac4057..839a2ba 100644 |
1492 | --- a/fs/udf/super.c |
1493 | +++ b/fs/udf/super.c |
1494 | @@ -630,6 +630,12 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options) |
1495 | struct udf_sb_info *sbi = UDF_SB(sb); |
1496 | int error = 0; |
1497 | |
1498 | + if (sbi->s_lvid_bh) { |
1499 | + int write_rev = le16_to_cpu(udf_sb_lvidiu(sbi)->minUDFWriteRev); |
1500 | + if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & MS_RDONLY)) |
1501 | + return -EACCES; |
1502 | + } |
1503 | + |
1504 | uopt.flags = sbi->s_flags; |
1505 | uopt.uid = sbi->s_uid; |
1506 | uopt.gid = sbi->s_gid; |
1507 | @@ -649,12 +655,6 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options) |
1508 | sbi->s_dmode = uopt.dmode; |
1509 | write_unlock(&sbi->s_cred_lock); |
1510 | |
1511 | - if (sbi->s_lvid_bh) { |
1512 | - int write_rev = le16_to_cpu(udf_sb_lvidiu(sbi)->minUDFWriteRev); |
1513 | - if (write_rev > UDF_MAX_WRITE_VERSION) |
1514 | - *flags |= MS_RDONLY; |
1515 | - } |
1516 | - |
1517 | if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) |
1518 | goto out_unlock; |
1519 | |
1520 | @@ -843,27 +843,38 @@ static int udf_find_fileset(struct super_block *sb, |
1521 | return 1; |
1522 | } |
1523 | |
1524 | +/* |
1525 | + * Load primary Volume Descriptor Sequence |
1526 | + * |
1527 | + * Return <0 on error, 0 on success. -EAGAIN is special meaning next sequence |
1528 | + * should be tried. |
1529 | + */ |
1530 | static int udf_load_pvoldesc(struct super_block *sb, sector_t block) |
1531 | { |
1532 | struct primaryVolDesc *pvoldesc; |
1533 | struct ustr *instr, *outstr; |
1534 | struct buffer_head *bh; |
1535 | uint16_t ident; |
1536 | - int ret = 1; |
1537 | + int ret = -ENOMEM; |
1538 | |
1539 | instr = kmalloc(sizeof(struct ustr), GFP_NOFS); |
1540 | if (!instr) |
1541 | - return 1; |
1542 | + return -ENOMEM; |
1543 | |
1544 | outstr = kmalloc(sizeof(struct ustr), GFP_NOFS); |
1545 | if (!outstr) |
1546 | goto out1; |
1547 | |
1548 | bh = udf_read_tagged(sb, block, block, &ident); |
1549 | - if (!bh) |
1550 | + if (!bh) { |
1551 | + ret = -EAGAIN; |
1552 | goto out2; |
1553 | + } |
1554 | |
1555 | - BUG_ON(ident != TAG_IDENT_PVD); |
1556 | + if (ident != TAG_IDENT_PVD) { |
1557 | + ret = -EIO; |
1558 | + goto out_bh; |
1559 | + } |
1560 | |
1561 | pvoldesc = (struct primaryVolDesc *)bh->b_data; |
1562 | |
1563 | @@ -889,8 +900,9 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block) |
1564 | if (udf_CS0toUTF8(outstr, instr)) |
1565 | udf_debug("volSetIdent[] = '%s'\n", outstr->u_name); |
1566 | |
1567 | - brelse(bh); |
1568 | ret = 0; |
1569 | +out_bh: |
1570 | + brelse(bh); |
1571 | out2: |
1572 | kfree(outstr); |
1573 | out1: |
1574 | @@ -947,7 +959,7 @@ static int udf_load_metadata_files(struct super_block *sb, int partition) |
1575 | |
1576 | if (mdata->s_mirror_fe == NULL) { |
1577 | udf_err(sb, "Both metadata and mirror metadata inode efe can not found\n"); |
1578 | - goto error_exit; |
1579 | + return -EIO; |
1580 | } |
1581 | } |
1582 | |
1583 | @@ -964,23 +976,18 @@ static int udf_load_metadata_files(struct super_block *sb, int partition) |
1584 | addr.logicalBlockNum, addr.partitionReferenceNum); |
1585 | |
1586 | mdata->s_bitmap_fe = udf_iget(sb, &addr); |
1587 | - |
1588 | if (mdata->s_bitmap_fe == NULL) { |
1589 | if (sb->s_flags & MS_RDONLY) |
1590 | udf_warn(sb, "bitmap inode efe not found but it's ok since the disc is mounted read-only\n"); |
1591 | else { |
1592 | udf_err(sb, "bitmap inode efe not found and attempted read-write mount\n"); |
1593 | - goto error_exit; |
1594 | + return -EIO; |
1595 | } |
1596 | } |
1597 | } |
1598 | |
1599 | udf_debug("udf_load_metadata_files Ok\n"); |
1600 | - |
1601 | return 0; |
1602 | - |
1603 | -error_exit: |
1604 | - return 1; |
1605 | } |
1606 | |
1607 | static void udf_load_fileset(struct super_block *sb, struct buffer_head *bh, |
1608 | @@ -1069,7 +1076,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, |
1609 | if (!map->s_uspace.s_table) { |
1610 | udf_debug("cannot load unallocSpaceTable (part %d)\n", |
1611 | p_index); |
1612 | - return 1; |
1613 | + return -EIO; |
1614 | } |
1615 | map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_TABLE; |
1616 | udf_debug("unallocSpaceTable (part %d) @ %ld\n", |
1617 | @@ -1079,7 +1086,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, |
1618 | if (phd->unallocSpaceBitmap.extLength) { |
1619 | struct udf_bitmap *bitmap = udf_sb_alloc_bitmap(sb, p_index); |
1620 | if (!bitmap) |
1621 | - return 1; |
1622 | + return -ENOMEM; |
1623 | map->s_uspace.s_bitmap = bitmap; |
1624 | bitmap->s_extPosition = le32_to_cpu( |
1625 | phd->unallocSpaceBitmap.extPosition); |
1626 | @@ -1102,7 +1109,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, |
1627 | if (!map->s_fspace.s_table) { |
1628 | udf_debug("cannot load freedSpaceTable (part %d)\n", |
1629 | p_index); |
1630 | - return 1; |
1631 | + return -EIO; |
1632 | } |
1633 | |
1634 | map->s_partition_flags |= UDF_PART_FLAG_FREED_TABLE; |
1635 | @@ -1113,7 +1120,7 @@ static int udf_fill_partdesc_info(struct super_block *sb, |
1636 | if (phd->freedSpaceBitmap.extLength) { |
1637 | struct udf_bitmap *bitmap = udf_sb_alloc_bitmap(sb, p_index); |
1638 | if (!bitmap) |
1639 | - return 1; |
1640 | + return -ENOMEM; |
1641 | map->s_fspace.s_bitmap = bitmap; |
1642 | bitmap->s_extPosition = le32_to_cpu( |
1643 | phd->freedSpaceBitmap.extPosition); |
1644 | @@ -1165,7 +1172,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) |
1645 | udf_find_vat_block(sb, p_index, type1_index, blocks - 1); |
1646 | } |
1647 | if (!sbi->s_vat_inode) |
1648 | - return 1; |
1649 | + return -EIO; |
1650 | |
1651 | if (map->s_partition_type == UDF_VIRTUAL_MAP15) { |
1652 | map->s_type_specific.s_virtual.s_start_offset = 0; |
1653 | @@ -1177,7 +1184,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) |
1654 | pos = udf_block_map(sbi->s_vat_inode, 0); |
1655 | bh = sb_bread(sb, pos); |
1656 | if (!bh) |
1657 | - return 1; |
1658 | + return -EIO; |
1659 | vat20 = (struct virtualAllocationTable20 *)bh->b_data; |
1660 | } else { |
1661 | vat20 = (struct virtualAllocationTable20 *) |
1662 | @@ -1195,6 +1202,12 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) |
1663 | return 0; |
1664 | } |
1665 | |
1666 | +/* |
1667 | + * Load partition descriptor block |
1668 | + * |
1669 | + * Returns <0 on error, 0 on success, -EAGAIN is special - try next descriptor |
1670 | + * sequence. |
1671 | + */ |
1672 | static int udf_load_partdesc(struct super_block *sb, sector_t block) |
1673 | { |
1674 | struct buffer_head *bh; |
1675 | @@ -1204,13 +1217,15 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) |
1676 | int i, type1_idx; |
1677 | uint16_t partitionNumber; |
1678 | uint16_t ident; |
1679 | - int ret = 0; |
1680 | + int ret; |
1681 | |
1682 | bh = udf_read_tagged(sb, block, block, &ident); |
1683 | if (!bh) |
1684 | - return 1; |
1685 | - if (ident != TAG_IDENT_PD) |
1686 | + return -EAGAIN; |
1687 | + if (ident != TAG_IDENT_PD) { |
1688 | + ret = 0; |
1689 | goto out_bh; |
1690 | + } |
1691 | |
1692 | p = (struct partitionDesc *)bh->b_data; |
1693 | partitionNumber = le16_to_cpu(p->partitionNumber); |
1694 | @@ -1229,10 +1244,13 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) |
1695 | if (i >= sbi->s_partitions) { |
1696 | udf_debug("Partition (%d) not found in partition map\n", |
1697 | partitionNumber); |
1698 | + ret = 0; |
1699 | goto out_bh; |
1700 | } |
1701 | |
1702 | ret = udf_fill_partdesc_info(sb, p, i); |
1703 | + if (ret < 0) |
1704 | + goto out_bh; |
1705 | |
1706 | /* |
1707 | * Now rescan for VIRTUAL or METADATA partitions when SPARABLE and |
1708 | @@ -1249,32 +1267,37 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block) |
1709 | break; |
1710 | } |
1711 | |
1712 | - if (i >= sbi->s_partitions) |
1713 | + if (i >= sbi->s_partitions) { |
1714 | + ret = 0; |
1715 | goto out_bh; |
1716 | + } |
1717 | |
1718 | ret = udf_fill_partdesc_info(sb, p, i); |
1719 | - if (ret) |
1720 | + if (ret < 0) |
1721 | goto out_bh; |
1722 | |
1723 | if (map->s_partition_type == UDF_METADATA_MAP25) { |
1724 | ret = udf_load_metadata_files(sb, i); |
1725 | - if (ret) { |
1726 | + if (ret < 0) { |
1727 | udf_err(sb, "error loading MetaData partition map %d\n", |
1728 | i); |
1729 | goto out_bh; |
1730 | } |
1731 | } else { |
1732 | - ret = udf_load_vat(sb, i, type1_idx); |
1733 | - if (ret) |
1734 | - goto out_bh; |
1735 | /* |
1736 | - * Mark filesystem read-only if we have a partition with |
1737 | - * virtual map since we don't handle writing to it (we |
1738 | - * overwrite blocks instead of relocating them). |
1739 | + * If we have a partition with virtual map, we don't handle |
1740 | + * writing to it (we overwrite blocks instead of relocating |
1741 | + * them). |
1742 | */ |
1743 | - sb->s_flags |= MS_RDONLY; |
1744 | - pr_notice("Filesystem marked read-only because writing to pseudooverwrite partition is not implemented\n"); |
1745 | + if (!(sb->s_flags & MS_RDONLY)) { |
1746 | + ret = -EACCES; |
1747 | + goto out_bh; |
1748 | + } |
1749 | + ret = udf_load_vat(sb, i, type1_idx); |
1750 | + if (ret < 0) |
1751 | + goto out_bh; |
1752 | } |
1753 | + ret = 0; |
1754 | out_bh: |
1755 | /* In case loading failed, we handle cleanup in udf_fill_super */ |
1756 | brelse(bh); |
1757 | @@ -1340,11 +1363,11 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, |
1758 | uint16_t ident; |
1759 | struct buffer_head *bh; |
1760 | unsigned int table_len; |
1761 | - int ret = 0; |
1762 | + int ret; |
1763 | |
1764 | bh = udf_read_tagged(sb, block, block, &ident); |
1765 | if (!bh) |
1766 | - return 1; |
1767 | + return -EAGAIN; |
1768 | BUG_ON(ident != TAG_IDENT_LVD); |
1769 | lvd = (struct logicalVolDesc *)bh->b_data; |
1770 | table_len = le32_to_cpu(lvd->mapTableLength); |
1771 | @@ -1352,7 +1375,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, |
1772 | udf_err(sb, "error loading logical volume descriptor: " |
1773 | "Partition table too long (%u > %lu)\n", table_len, |
1774 | sb->s_blocksize - sizeof(*lvd)); |
1775 | - ret = 1; |
1776 | + ret = -EIO; |
1777 | goto out_bh; |
1778 | } |
1779 | |
1780 | @@ -1396,11 +1419,10 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, |
1781 | } else if (!strncmp(upm2->partIdent.ident, |
1782 | UDF_ID_SPARABLE, |
1783 | strlen(UDF_ID_SPARABLE))) { |
1784 | - if (udf_load_sparable_map(sb, map, |
1785 | - (struct sparablePartitionMap *)gpm) < 0) { |
1786 | - ret = 1; |
1787 | + ret = udf_load_sparable_map(sb, map, |
1788 | + (struct sparablePartitionMap *)gpm); |
1789 | + if (ret < 0) |
1790 | goto out_bh; |
1791 | - } |
1792 | } else if (!strncmp(upm2->partIdent.ident, |
1793 | UDF_ID_METADATA, |
1794 | strlen(UDF_ID_METADATA))) { |
1795 | @@ -1465,7 +1487,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, |
1796 | } |
1797 | if (lvd->integritySeqExt.extLength) |
1798 | udf_load_logicalvolint(sb, leea_to_cpu(lvd->integritySeqExt)); |
1799 | - |
1800 | + ret = 0; |
1801 | out_bh: |
1802 | brelse(bh); |
1803 | return ret; |
1804 | @@ -1503,22 +1525,18 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ |
1805 | } |
1806 | |
1807 | /* |
1808 | - * udf_process_sequence |
1809 | - * |
1810 | - * PURPOSE |
1811 | - * Process a main/reserve volume descriptor sequence. |
1812 | - * |
1813 | - * PRE-CONDITIONS |
1814 | - * sb Pointer to _locked_ superblock. |
1815 | - * block First block of first extent of the sequence. |
1816 | - * lastblock Lastblock of first extent of the sequence. |
1817 | + * Process a main/reserve volume descriptor sequence. |
1818 | + * @block First block of first extent of the sequence. |
1819 | + * @lastblock Lastblock of first extent of the sequence. |
1820 | + * @fileset There we store extent containing root fileset |
1821 | * |
1822 | - * HISTORY |
1823 | - * July 1, 1997 - Andrew E. Mileski |
1824 | - * Written, tested, and released. |
1825 | + * Returns <0 on error, 0 on success. -EAGAIN is special - try next descriptor |
1826 | + * sequence |
1827 | */ |
1828 | -static noinline int udf_process_sequence(struct super_block *sb, long block, |
1829 | - long lastblock, struct kernel_lb_addr *fileset) |
1830 | +static noinline int udf_process_sequence( |
1831 | + struct super_block *sb, |
1832 | + sector_t block, sector_t lastblock, |
1833 | + struct kernel_lb_addr *fileset) |
1834 | { |
1835 | struct buffer_head *bh = NULL; |
1836 | struct udf_vds_record vds[VDS_POS_LENGTH]; |
1837 | @@ -1529,6 +1547,7 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, |
1838 | uint32_t vdsn; |
1839 | uint16_t ident; |
1840 | long next_s = 0, next_e = 0; |
1841 | + int ret; |
1842 | |
1843 | memset(vds, 0, sizeof(struct udf_vds_record) * VDS_POS_LENGTH); |
1844 | |
1845 | @@ -1543,7 +1562,7 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, |
1846 | udf_err(sb, |
1847 | "Block %llu of volume descriptor sequence is corrupted or we could not read it\n", |
1848 | (unsigned long long)block); |
1849 | - return 1; |
1850 | + return -EAGAIN; |
1851 | } |
1852 | |
1853 | /* Process each descriptor (ISO 13346 3/8.3-8.4) */ |
1854 | @@ -1616,14 +1635,19 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, |
1855 | */ |
1856 | if (!vds[VDS_POS_PRIMARY_VOL_DESC].block) { |
1857 | udf_err(sb, "Primary Volume Descriptor not found!\n"); |
1858 | - return 1; |
1859 | + return -EAGAIN; |
1860 | + } |
1861 | + ret = udf_load_pvoldesc(sb, vds[VDS_POS_PRIMARY_VOL_DESC].block); |
1862 | + if (ret < 0) |
1863 | + return ret; |
1864 | + |
1865 | + if (vds[VDS_POS_LOGICAL_VOL_DESC].block) { |
1866 | + ret = udf_load_logicalvol(sb, |
1867 | + vds[VDS_POS_LOGICAL_VOL_DESC].block, |
1868 | + fileset); |
1869 | + if (ret < 0) |
1870 | + return ret; |
1871 | } |
1872 | - if (udf_load_pvoldesc(sb, vds[VDS_POS_PRIMARY_VOL_DESC].block)) |
1873 | - return 1; |
1874 | - |
1875 | - if (vds[VDS_POS_LOGICAL_VOL_DESC].block && udf_load_logicalvol(sb, |
1876 | - vds[VDS_POS_LOGICAL_VOL_DESC].block, fileset)) |
1877 | - return 1; |
1878 | |
1879 | if (vds[VDS_POS_PARTITION_DESC].block) { |
1880 | /* |
1881 | @@ -1632,19 +1656,27 @@ static noinline int udf_process_sequence(struct super_block *sb, long block, |
1882 | */ |
1883 | for (block = vds[VDS_POS_PARTITION_DESC].block; |
1884 | block < vds[VDS_POS_TERMINATING_DESC].block; |
1885 | - block++) |
1886 | - if (udf_load_partdesc(sb, block)) |
1887 | - return 1; |
1888 | + block++) { |
1889 | + ret = udf_load_partdesc(sb, block); |
1890 | + if (ret < 0) |
1891 | + return ret; |
1892 | + } |
1893 | } |
1894 | |
1895 | return 0; |
1896 | } |
1897 | |
1898 | +/* |
1899 | + * Load Volume Descriptor Sequence described by anchor in bh |
1900 | + * |
1901 | + * Returns <0 on error, 0 on success |
1902 | + */ |
1903 | static int udf_load_sequence(struct super_block *sb, struct buffer_head *bh, |
1904 | struct kernel_lb_addr *fileset) |
1905 | { |
1906 | struct anchorVolDescPtr *anchor; |
1907 | - long main_s, main_e, reserve_s, reserve_e; |
1908 | + sector_t main_s, main_e, reserve_s, reserve_e; |
1909 | + int ret; |
1910 | |
1911 | anchor = (struct anchorVolDescPtr *)bh->b_data; |
1912 | |
1913 | @@ -1662,18 +1694,26 @@ static int udf_load_sequence(struct super_block *sb, struct buffer_head *bh, |
1914 | |
1915 | /* Process the main & reserve sequences */ |
1916 | /* responsible for finding the PartitionDesc(s) */ |
1917 | - if (!udf_process_sequence(sb, main_s, main_e, fileset)) |
1918 | - return 1; |
1919 | - udf_sb_free_partitions(sb); |
1920 | - if (!udf_process_sequence(sb, reserve_s, reserve_e, fileset)) |
1921 | - return 1; |
1922 | + ret = udf_process_sequence(sb, main_s, main_e, fileset); |
1923 | + if (ret != -EAGAIN) |
1924 | + return ret; |
1925 | udf_sb_free_partitions(sb); |
1926 | - return 0; |
1927 | + ret = udf_process_sequence(sb, reserve_s, reserve_e, fileset); |
1928 | + if (ret < 0) { |
1929 | + udf_sb_free_partitions(sb); |
1930 | + /* No sequence was OK, return -EIO */ |
1931 | + if (ret == -EAGAIN) |
1932 | + ret = -EIO; |
1933 | + } |
1934 | + return ret; |
1935 | } |
1936 | |
1937 | /* |
1938 | * Check whether there is an anchor block in the given block and |
1939 | * load Volume Descriptor Sequence if so. |
1940 | + * |
1941 | + * Returns <0 on error, 0 on success, -EAGAIN is special - try next anchor |
1942 | + * block |
1943 | */ |
1944 | static int udf_check_anchor_block(struct super_block *sb, sector_t block, |
1945 | struct kernel_lb_addr *fileset) |
1946 | @@ -1685,33 +1725,40 @@ static int udf_check_anchor_block(struct super_block *sb, sector_t block, |
1947 | if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV) && |
1948 | udf_fixed_to_variable(block) >= |
1949 | sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits) |
1950 | - return 0; |
1951 | + return -EAGAIN; |
1952 | |
1953 | bh = udf_read_tagged(sb, block, block, &ident); |
1954 | if (!bh) |
1955 | - return 0; |
1956 | + return -EAGAIN; |
1957 | if (ident != TAG_IDENT_AVDP) { |
1958 | brelse(bh); |
1959 | - return 0; |
1960 | + return -EAGAIN; |
1961 | } |
1962 | ret = udf_load_sequence(sb, bh, fileset); |
1963 | brelse(bh); |
1964 | return ret; |
1965 | } |
1966 | |
1967 | -/* Search for an anchor volume descriptor pointer */ |
1968 | -static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock, |
1969 | - struct kernel_lb_addr *fileset) |
1970 | +/* |
1971 | + * Search for an anchor volume descriptor pointer. |
1972 | + * |
1973 | + * Returns < 0 on error, 0 on success. -EAGAIN is special - try next set |
1974 | + * of anchors. |
1975 | + */ |
1976 | +static int udf_scan_anchors(struct super_block *sb, sector_t *lastblock, |
1977 | + struct kernel_lb_addr *fileset) |
1978 | { |
1979 | sector_t last[6]; |
1980 | int i; |
1981 | struct udf_sb_info *sbi = UDF_SB(sb); |
1982 | int last_count = 0; |
1983 | + int ret; |
1984 | |
1985 | /* First try user provided anchor */ |
1986 | if (sbi->s_anchor) { |
1987 | - if (udf_check_anchor_block(sb, sbi->s_anchor, fileset)) |
1988 | - return lastblock; |
1989 | + ret = udf_check_anchor_block(sb, sbi->s_anchor, fileset); |
1990 | + if (ret != -EAGAIN) |
1991 | + return ret; |
1992 | } |
1993 | /* |
1994 | * according to spec, anchor is in either: |
1995 | @@ -1720,39 +1767,46 @@ static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock, |
1996 | * lastblock |
1997 | * however, if the disc isn't closed, it could be 512. |
1998 | */ |
1999 | - if (udf_check_anchor_block(sb, sbi->s_session + 256, fileset)) |
2000 | - return lastblock; |
2001 | + ret = udf_check_anchor_block(sb, sbi->s_session + 256, fileset); |
2002 | + if (ret != -EAGAIN) |
2003 | + return ret; |
2004 | /* |
2005 | * The trouble is which block is the last one. Drives often misreport |
2006 | * this so we try various possibilities. |
2007 | */ |
2008 | - last[last_count++] = lastblock; |
2009 | - if (lastblock >= 1) |
2010 | - last[last_count++] = lastblock - 1; |
2011 | - last[last_count++] = lastblock + 1; |
2012 | - if (lastblock >= 2) |
2013 | - last[last_count++] = lastblock - 2; |
2014 | - if (lastblock >= 150) |
2015 | - last[last_count++] = lastblock - 150; |
2016 | - if (lastblock >= 152) |
2017 | - last[last_count++] = lastblock - 152; |
2018 | + last[last_count++] = *lastblock; |
2019 | + if (*lastblock >= 1) |
2020 | + last[last_count++] = *lastblock - 1; |
2021 | + last[last_count++] = *lastblock + 1; |
2022 | + if (*lastblock >= 2) |
2023 | + last[last_count++] = *lastblock - 2; |
2024 | + if (*lastblock >= 150) |
2025 | + last[last_count++] = *lastblock - 150; |
2026 | + if (*lastblock >= 152) |
2027 | + last[last_count++] = *lastblock - 152; |
2028 | |
2029 | for (i = 0; i < last_count; i++) { |
2030 | if (last[i] >= sb->s_bdev->bd_inode->i_size >> |
2031 | sb->s_blocksize_bits) |
2032 | continue; |
2033 | - if (udf_check_anchor_block(sb, last[i], fileset)) |
2034 | - return last[i]; |
2035 | + ret = udf_check_anchor_block(sb, last[i], fileset); |
2036 | + if (ret != -EAGAIN) { |
2037 | + if (!ret) |
2038 | + *lastblock = last[i]; |
2039 | + return ret; |
2040 | + } |
2041 | if (last[i] < 256) |
2042 | continue; |
2043 | - if (udf_check_anchor_block(sb, last[i] - 256, fileset)) |
2044 | - return last[i]; |
2045 | + ret = udf_check_anchor_block(sb, last[i] - 256, fileset); |
2046 | + if (ret != -EAGAIN) { |
2047 | + if (!ret) |
2048 | + *lastblock = last[i]; |
2049 | + return ret; |
2050 | + } |
2051 | } |
2052 | |
2053 | /* Finally try block 512 in case media is open */ |
2054 | - if (udf_check_anchor_block(sb, sbi->s_session + 512, fileset)) |
2055 | - return last[0]; |
2056 | - return 0; |
2057 | + return udf_check_anchor_block(sb, sbi->s_session + 512, fileset); |
2058 | } |
2059 | |
2060 | /* |
2061 | @@ -1760,54 +1814,59 @@ static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock, |
2062 | * area specified by it. The function expects sbi->s_lastblock to be the last |
2063 | * block on the media. |
2064 | * |
2065 | - * Return 1 if ok, 0 if not found. |
2066 | - * |
2067 | + * Return <0 on error, 0 if anchor found. -EAGAIN is special meaning anchor |
2068 | + * was not found. |
2069 | */ |
2070 | static int udf_find_anchor(struct super_block *sb, |
2071 | struct kernel_lb_addr *fileset) |
2072 | { |
2073 | - sector_t lastblock; |
2074 | struct udf_sb_info *sbi = UDF_SB(sb); |
2075 | + sector_t lastblock = sbi->s_last_block; |
2076 | + int ret; |
2077 | |
2078 | - lastblock = udf_scan_anchors(sb, sbi->s_last_block, fileset); |
2079 | - if (lastblock) |
2080 | + ret = udf_scan_anchors(sb, &lastblock, fileset); |
2081 | + if (ret != -EAGAIN) |
2082 | goto out; |
2083 | |
2084 | /* No anchor found? Try VARCONV conversion of block numbers */ |
2085 | UDF_SET_FLAG(sb, UDF_FLAG_VARCONV); |
2086 | + lastblock = udf_variable_to_fixed(sbi->s_last_block); |
2087 | /* Firstly, we try to not convert number of the last block */ |
2088 | - lastblock = udf_scan_anchors(sb, |
2089 | - udf_variable_to_fixed(sbi->s_last_block), |
2090 | - fileset); |
2091 | - if (lastblock) |
2092 | + ret = udf_scan_anchors(sb, &lastblock, fileset); |
2093 | + if (ret != -EAGAIN) |
2094 | goto out; |
2095 | |
2096 | + lastblock = sbi->s_last_block; |
2097 | /* Secondly, we try with converted number of the last block */ |
2098 | - lastblock = udf_scan_anchors(sb, sbi->s_last_block, fileset); |
2099 | - if (!lastblock) { |
2100 | + ret = udf_scan_anchors(sb, &lastblock, fileset); |
2101 | + if (ret < 0) { |
2102 | /* VARCONV didn't help. Clear it. */ |
2103 | UDF_CLEAR_FLAG(sb, UDF_FLAG_VARCONV); |
2104 | - return 0; |
2105 | } |
2106 | out: |
2107 | - sbi->s_last_block = lastblock; |
2108 | - return 1; |
2109 | + if (ret == 0) |
2110 | + sbi->s_last_block = lastblock; |
2111 | + return ret; |
2112 | } |
2113 | |
2114 | /* |
2115 | * Check Volume Structure Descriptor, find Anchor block and load Volume |
2116 | - * Descriptor Sequence |
2117 | + * Descriptor Sequence. |
2118 | + * |
2119 | + * Returns < 0 on error, 0 on success. -EAGAIN is special meaning anchor |
2120 | + * block was not found. |
2121 | */ |
2122 | static int udf_load_vrs(struct super_block *sb, struct udf_options *uopt, |
2123 | int silent, struct kernel_lb_addr *fileset) |
2124 | { |
2125 | struct udf_sb_info *sbi = UDF_SB(sb); |
2126 | loff_t nsr_off; |
2127 | + int ret; |
2128 | |
2129 | if (!sb_set_blocksize(sb, uopt->blocksize)) { |
2130 | if (!silent) |
2131 | udf_warn(sb, "Bad block size\n"); |
2132 | - return 0; |
2133 | + return -EINVAL; |
2134 | } |
2135 | sbi->s_last_block = uopt->lastblock; |
2136 | if (!uopt->novrs) { |
2137 | @@ -1828,12 +1887,13 @@ static int udf_load_vrs(struct super_block *sb, struct udf_options *uopt, |
2138 | |
2139 | /* Look for anchor block and load Volume Descriptor Sequence */ |
2140 | sbi->s_anchor = uopt->anchor; |
2141 | - if (!udf_find_anchor(sb, fileset)) { |
2142 | - if (!silent) |
2143 | + ret = udf_find_anchor(sb, fileset); |
2144 | + if (ret < 0) { |
2145 | + if (!silent && ret == -EAGAIN) |
2146 | udf_warn(sb, "No anchor found\n"); |
2147 | - return 0; |
2148 | + return ret; |
2149 | } |
2150 | - return 1; |
2151 | + return 0; |
2152 | } |
2153 | |
2154 | static void udf_open_lvid(struct super_block *sb) |
2155 | @@ -1939,7 +1999,7 @@ u64 lvid_get_unique_id(struct super_block *sb) |
2156 | |
2157 | static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2158 | { |
2159 | - int ret; |
2160 | + int ret = -EINVAL; |
2161 | struct inode *inode = NULL; |
2162 | struct udf_options uopt; |
2163 | struct kernel_lb_addr rootdir, fileset; |
2164 | @@ -2011,7 +2071,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2165 | } else { |
2166 | uopt.blocksize = bdev_logical_block_size(sb->s_bdev); |
2167 | ret = udf_load_vrs(sb, &uopt, silent, &fileset); |
2168 | - if (!ret && uopt.blocksize != UDF_DEFAULT_BLOCKSIZE) { |
2169 | + if (ret == -EAGAIN && uopt.blocksize != UDF_DEFAULT_BLOCKSIZE) { |
2170 | if (!silent) |
2171 | pr_notice("Rescanning with blocksize %d\n", |
2172 | UDF_DEFAULT_BLOCKSIZE); |
2173 | @@ -2021,8 +2081,11 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2174 | ret = udf_load_vrs(sb, &uopt, silent, &fileset); |
2175 | } |
2176 | } |
2177 | - if (!ret) { |
2178 | - udf_warn(sb, "No partition found (1)\n"); |
2179 | + if (ret < 0) { |
2180 | + if (ret == -EAGAIN) { |
2181 | + udf_warn(sb, "No partition found (1)\n"); |
2182 | + ret = -EINVAL; |
2183 | + } |
2184 | goto error_out; |
2185 | } |
2186 | |
2187 | @@ -2040,9 +2103,13 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2188 | udf_err(sb, "minUDFReadRev=%x (max is %x)\n", |
2189 | le16_to_cpu(lvidiu->minUDFReadRev), |
2190 | UDF_MAX_READ_VERSION); |
2191 | + ret = -EINVAL; |
2192 | + goto error_out; |
2193 | + } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION && |
2194 | + !(sb->s_flags & MS_RDONLY)) { |
2195 | + ret = -EACCES; |
2196 | goto error_out; |
2197 | - } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION) |
2198 | - sb->s_flags |= MS_RDONLY; |
2199 | + } |
2200 | |
2201 | sbi->s_udfrev = minUDFWriteRev; |
2202 | |
2203 | @@ -2054,17 +2121,20 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2204 | |
2205 | if (!sbi->s_partitions) { |
2206 | udf_warn(sb, "No partition found (2)\n"); |
2207 | + ret = -EINVAL; |
2208 | goto error_out; |
2209 | } |
2210 | |
2211 | if (sbi->s_partmaps[sbi->s_partition].s_partition_flags & |
2212 | - UDF_PART_FLAG_READ_ONLY) { |
2213 | - pr_notice("Partition marked readonly; forcing readonly mount\n"); |
2214 | - sb->s_flags |= MS_RDONLY; |
2215 | + UDF_PART_FLAG_READ_ONLY && |
2216 | + !(sb->s_flags & MS_RDONLY)) { |
2217 | + ret = -EACCES; |
2218 | + goto error_out; |
2219 | } |
2220 | |
2221 | if (udf_find_fileset(sb, &fileset, &rootdir)) { |
2222 | udf_warn(sb, "No fileset found\n"); |
2223 | + ret = -EINVAL; |
2224 | goto error_out; |
2225 | } |
2226 | |
2227 | @@ -2086,6 +2156,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2228 | if (!inode) { |
2229 | udf_err(sb, "Error in udf_iget, block=%d, partition=%d\n", |
2230 | rootdir.logicalBlockNum, rootdir.partitionReferenceNum); |
2231 | + ret = -EIO; |
2232 | goto error_out; |
2233 | } |
2234 | |
2235 | @@ -2093,6 +2164,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) |
2236 | sb->s_root = d_make_root(inode); |
2237 | if (!sb->s_root) { |
2238 | udf_err(sb, "Couldn't allocate root dentry\n"); |
2239 | + ret = -ENOMEM; |
2240 | goto error_out; |
2241 | } |
2242 | sb->s_maxbytes = MAX_LFS_FILESIZE; |
2243 | @@ -2113,7 +2185,7 @@ error_out: |
2244 | kfree(sbi); |
2245 | sb->s_fs_info = NULL; |
2246 | |
2247 | - return -EINVAL; |
2248 | + return ret; |
2249 | } |
2250 | |
2251 | void _udf_err(struct super_block *sb, const char *function, |
2252 | diff --git a/include/linux/hid.h b/include/linux/hid.h |
2253 | index ff545cc..6e18550 100644 |
2254 | --- a/include/linux/hid.h |
2255 | +++ b/include/linux/hid.h |
2256 | @@ -749,6 +749,10 @@ void hid_output_report(struct hid_report *report, __u8 *data); |
2257 | struct hid_device *hid_allocate_device(void); |
2258 | struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id); |
2259 | int hid_parse_report(struct hid_device *hid, __u8 *start, unsigned size); |
2260 | +struct hid_report *hid_validate_values(struct hid_device *hid, |
2261 | + unsigned int type, unsigned int id, |
2262 | + unsigned int field_index, |
2263 | + unsigned int report_counts); |
2264 | int hid_open_report(struct hid_device *device); |
2265 | int hid_check_keys_pressed(struct hid_device *hid); |
2266 | int hid_connect(struct hid_device *hid, unsigned int connect_mask); |
2267 | diff --git a/include/linux/timex.h b/include/linux/timex.h |
2268 | index b3726e6..dd3edd7 100644 |
2269 | --- a/include/linux/timex.h |
2270 | +++ b/include/linux/timex.h |
2271 | @@ -141,6 +141,7 @@ extern int do_adjtimex(struct timex *); |
2272 | extern void hardpps(const struct timespec *, const struct timespec *); |
2273 | |
2274 | int read_current_timer(unsigned long *timer_val); |
2275 | +void ntp_notify_cmos_timer(void); |
2276 | |
2277 | /* The clock frequency of the i8253/i8254 PIT */ |
2278 | #define PIT_TICK_RATE 1193182ul |
2279 | diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h |
2280 | index 321d4ac..fa8b3ad 100644 |
2281 | --- a/include/uapi/drm/radeon_drm.h |
2282 | +++ b/include/uapi/drm/radeon_drm.h |
2283 | @@ -979,6 +979,8 @@ struct drm_radeon_cs { |
2284 | #define RADEON_INFO_RING_WORKING 0x15 |
2285 | /* SI tile mode array */ |
2286 | #define RADEON_INFO_SI_TILE_MODE_ARRAY 0x16 |
2287 | +/* query if CP DMA is supported on the compute ring */ |
2288 | +#define RADEON_INFO_SI_CP_DMA_COMPUTE 0x17 |
2289 | |
2290 | |
2291 | struct drm_radeon_info { |
2292 | diff --git a/kernel/audit.c b/kernel/audit.c |
2293 | index 91e53d0..7b0e23a 100644 |
2294 | --- a/kernel/audit.c |
2295 | +++ b/kernel/audit.c |
2296 | @@ -1117,9 +1117,10 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, |
2297 | |
2298 | sleep_time = timeout_start + audit_backlog_wait_time - |
2299 | jiffies; |
2300 | - if ((long)sleep_time > 0) |
2301 | + if ((long)sleep_time > 0) { |
2302 | wait_for_auditd(sleep_time); |
2303 | - continue; |
2304 | + continue; |
2305 | + } |
2306 | } |
2307 | if (audit_rate_check() && printk_ratelimit()) |
2308 | printk(KERN_WARNING |
2309 | diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c |
2310 | index b5ccba2..1101d92 100644 |
2311 | --- a/kernel/sched/cputime.c |
2312 | +++ b/kernel/sched/cputime.c |
2313 | @@ -558,7 +558,7 @@ static void cputime_adjust(struct task_cputime *curr, |
2314 | struct cputime *prev, |
2315 | cputime_t *ut, cputime_t *st) |
2316 | { |
2317 | - cputime_t rtime, stime, utime, total; |
2318 | + cputime_t rtime, stime, utime; |
2319 | |
2320 | if (vtime_accounting_enabled()) { |
2321 | *ut = curr->utime; |
2322 | @@ -566,9 +566,6 @@ static void cputime_adjust(struct task_cputime *curr, |
2323 | return; |
2324 | } |
2325 | |
2326 | - stime = curr->stime; |
2327 | - total = stime + curr->utime; |
2328 | - |
2329 | /* |
2330 | * Tick based cputime accounting depend on random scheduling |
2331 | * timeslices of a task to be interrupted or not by the timer. |
2332 | @@ -589,13 +586,19 @@ static void cputime_adjust(struct task_cputime *curr, |
2333 | if (prev->stime + prev->utime >= rtime) |
2334 | goto out; |
2335 | |
2336 | - if (total) { |
2337 | + stime = curr->stime; |
2338 | + utime = curr->utime; |
2339 | + |
2340 | + if (utime == 0) { |
2341 | + stime = rtime; |
2342 | + } else if (stime == 0) { |
2343 | + utime = rtime; |
2344 | + } else { |
2345 | + cputime_t total = stime + utime; |
2346 | + |
2347 | stime = scale_stime((__force u64)stime, |
2348 | (__force u64)rtime, (__force u64)total); |
2349 | utime = rtime - stime; |
2350 | - } else { |
2351 | - stime = rtime; |
2352 | - utime = 0; |
2353 | } |
2354 | |
2355 | /* |
2356 | diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c |
2357 | index 03b73be..009a62b 100644 |
2358 | --- a/kernel/sched/fair.c |
2359 | +++ b/kernel/sched/fair.c |
2360 | @@ -5778,11 +5778,15 @@ static void task_fork_fair(struct task_struct *p) |
2361 | cfs_rq = task_cfs_rq(current); |
2362 | curr = cfs_rq->curr; |
2363 | |
2364 | - if (unlikely(task_cpu(p) != this_cpu)) { |
2365 | - rcu_read_lock(); |
2366 | - __set_task_cpu(p, this_cpu); |
2367 | - rcu_read_unlock(); |
2368 | - } |
2369 | + /* |
2370 | + * Not only the cpu but also the task_group of the parent might have |
2371 | + * been changed after parent->se.parent,cfs_rq were copied to |
2372 | + * child->se.parent,cfs_rq. So call __set_task_cpu() to make those |
2373 | + * of child point to valid ones. |
2374 | + */ |
2375 | + rcu_read_lock(); |
2376 | + __set_task_cpu(p, this_cpu); |
2377 | + rcu_read_unlock(); |
2378 | |
2379 | update_curr(cfs_rq); |
2380 | |
2381 | diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c |
2382 | index 8f5b3b9..bb22151 100644 |
2383 | --- a/kernel/time/ntp.c |
2384 | +++ b/kernel/time/ntp.c |
2385 | @@ -516,13 +516,13 @@ static void sync_cmos_clock(struct work_struct *work) |
2386 | schedule_delayed_work(&sync_cmos_work, timespec_to_jiffies(&next)); |
2387 | } |
2388 | |
2389 | -static void notify_cmos_timer(void) |
2390 | +void ntp_notify_cmos_timer(void) |
2391 | { |
2392 | schedule_delayed_work(&sync_cmos_work, 0); |
2393 | } |
2394 | |
2395 | #else |
2396 | -static inline void notify_cmos_timer(void) { } |
2397 | +void ntp_notify_cmos_timer(void) { } |
2398 | #endif |
2399 | |
2400 | |
2401 | @@ -687,8 +687,6 @@ int __do_adjtimex(struct timex *txc, struct timespec *ts, s32 *time_tai) |
2402 | if (!(time_status & STA_NANO)) |
2403 | txc->time.tv_usec /= NSEC_PER_USEC; |
2404 | |
2405 | - notify_cmos_timer(); |
2406 | - |
2407 | return result; |
2408 | } |
2409 | |
2410 | diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c |
2411 | index baeeb5c..fcc261c 100644 |
2412 | --- a/kernel/time/timekeeping.c |
2413 | +++ b/kernel/time/timekeeping.c |
2414 | @@ -1682,6 +1682,8 @@ int do_adjtimex(struct timex *txc) |
2415 | write_seqcount_end(&timekeeper_seq); |
2416 | raw_spin_unlock_irqrestore(&timekeeper_lock, flags); |
2417 | |
2418 | + ntp_notify_cmos_timer(); |
2419 | + |
2420 | return ret; |
2421 | } |
2422 | |
2423 | diff --git a/mm/swap.c b/mm/swap.c |
2424 | index dfd7d71..9f2225f 100644 |
2425 | --- a/mm/swap.c |
2426 | +++ b/mm/swap.c |
2427 | @@ -31,6 +31,7 @@ |
2428 | #include <linux/memcontrol.h> |
2429 | #include <linux/gfp.h> |
2430 | #include <linux/uio.h> |
2431 | +#include <linux/hugetlb.h> |
2432 | |
2433 | #include "internal.h" |
2434 | |
2435 | @@ -78,6 +79,19 @@ static void __put_compound_page(struct page *page) |
2436 | |
2437 | static void put_compound_page(struct page *page) |
2438 | { |
2439 | + /* |
2440 | + * hugetlbfs pages cannot be split from under us. If this is a |
2441 | + * hugetlbfs page, check refcount on head page and release the page if |
2442 | + * the refcount becomes zero. |
2443 | + */ |
2444 | + if (PageHuge(page)) { |
2445 | + page = compound_head(page); |
2446 | + if (put_page_testzero(page)) |
2447 | + __put_compound_page(page); |
2448 | + |
2449 | + return; |
2450 | + } |
2451 | + |
2452 | if (unlikely(PageTail(page))) { |
2453 | /* __split_huge_page_refcount can run under us */ |
2454 | struct page *page_head = compound_trans_head(page); |
2455 | @@ -181,38 +195,51 @@ bool __get_page_tail(struct page *page) |
2456 | * proper PT lock that already serializes against |
2457 | * split_huge_page(). |
2458 | */ |
2459 | - unsigned long flags; |
2460 | bool got = false; |
2461 | - struct page *page_head = compound_trans_head(page); |
2462 | + struct page *page_head; |
2463 | |
2464 | - if (likely(page != page_head && get_page_unless_zero(page_head))) { |
2465 | + /* |
2466 | + * If this is a hugetlbfs page it cannot be split under us. Simply |
2467 | + * increment refcount for the head page. |
2468 | + */ |
2469 | + if (PageHuge(page)) { |
2470 | + page_head = compound_head(page); |
2471 | + atomic_inc(&page_head->_count); |
2472 | + got = true; |
2473 | + } else { |
2474 | + unsigned long flags; |
2475 | + |
2476 | + page_head = compound_trans_head(page); |
2477 | + if (likely(page != page_head && |
2478 | + get_page_unless_zero(page_head))) { |
2479 | + |
2480 | + /* Ref to put_compound_page() comment. */ |
2481 | + if (PageSlab(page_head)) { |
2482 | + if (likely(PageTail(page))) { |
2483 | + __get_page_tail_foll(page, false); |
2484 | + return true; |
2485 | + } else { |
2486 | + put_page(page_head); |
2487 | + return false; |
2488 | + } |
2489 | + } |
2490 | |
2491 | - /* Ref to put_compound_page() comment. */ |
2492 | - if (PageSlab(page_head)) { |
2493 | + /* |
2494 | + * page_head wasn't a dangling pointer but it |
2495 | + * may not be a head page anymore by the time |
2496 | + * we obtain the lock. That is ok as long as it |
2497 | + * can't be freed from under us. |
2498 | + */ |
2499 | + flags = compound_lock_irqsave(page_head); |
2500 | + /* here __split_huge_page_refcount won't run anymore */ |
2501 | if (likely(PageTail(page))) { |
2502 | __get_page_tail_foll(page, false); |
2503 | - return true; |
2504 | - } else { |
2505 | - put_page(page_head); |
2506 | - return false; |
2507 | + got = true; |
2508 | } |
2509 | + compound_unlock_irqrestore(page_head, flags); |
2510 | + if (unlikely(!got)) |
2511 | + put_page(page_head); |
2512 | } |
2513 | - |
2514 | - /* |
2515 | - * page_head wasn't a dangling pointer but it |
2516 | - * may not be a head page anymore by the time |
2517 | - * we obtain the lock. That is ok as long as it |
2518 | - * can't be freed from under us. |
2519 | - */ |
2520 | - flags = compound_lock_irqsave(page_head); |
2521 | - /* here __split_huge_page_refcount won't run anymore */ |
2522 | - if (likely(PageTail(page))) { |
2523 | - __get_page_tail_foll(page, false); |
2524 | - got = true; |
2525 | - } |
2526 | - compound_unlock_irqrestore(page_head, flags); |
2527 | - if (unlikely(!got)) |
2528 | - put_page(page_head); |
2529 | } |
2530 | return got; |
2531 | } |
2532 | diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h |
2533 | index 57beb17..707bc52 100644 |
2534 | --- a/net/netfilter/ipset/ip_set_hash_gen.h |
2535 | +++ b/net/netfilter/ipset/ip_set_hash_gen.h |
2536 | @@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length) |
2537 | static void |
2538 | mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length) |
2539 | { |
2540 | - u8 i, j; |
2541 | - |
2542 | - for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++) |
2543 | - ; |
2544 | - h->nets[i].nets--; |
2545 | - |
2546 | - if (h->nets[i].nets != 0) |
2547 | - return; |
2548 | - |
2549 | - for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) { |
2550 | - h->nets[j].cidr = h->nets[j + 1].cidr; |
2551 | - h->nets[j].nets = h->nets[j + 1].nets; |
2552 | + u8 i, j, net_end = nets_length - 1; |
2553 | + |
2554 | + for (i = 0; i < nets_length; i++) { |
2555 | + if (h->nets[i].cidr != cidr) |
2556 | + continue; |
2557 | + if (h->nets[i].nets > 1 || i == net_end || |
2558 | + h->nets[i + 1].nets == 0) { |
2559 | + h->nets[i].nets--; |
2560 | + return; |
2561 | + } |
2562 | + for (j = i; j < net_end && h->nets[j].nets; j++) { |
2563 | + h->nets[j].cidr = h->nets[j + 1].cidr; |
2564 | + h->nets[j].nets = h->nets[j + 1].nets; |
2565 | + } |
2566 | + h->nets[j].nets = 0; |
2567 | + return; |
2568 | } |
2569 | } |
2570 | #endif |
2571 | diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c |
2572 | index af7ffd4..f1eb0d1 100644 |
2573 | --- a/net/sunrpc/auth_gss/gss_rpc_upcall.c |
2574 | +++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c |
2575 | @@ -213,6 +213,26 @@ static int gssp_call(struct net *net, struct rpc_message *msg) |
2576 | return status; |
2577 | } |
2578 | |
2579 | +static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg) |
2580 | +{ |
2581 | + int i; |
2582 | + |
2583 | + for (i = 0; i < arg->npages && arg->pages[i]; i++) |
2584 | + __free_page(arg->pages[i]); |
2585 | +} |
2586 | + |
2587 | +static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg) |
2588 | +{ |
2589 | + arg->npages = DIV_ROUND_UP(NGROUPS_MAX * 4, PAGE_SIZE); |
2590 | + arg->pages = kzalloc(arg->npages * sizeof(struct page *), GFP_KERNEL); |
2591 | + /* |
2592 | + * XXX: actual pages are allocated by xdr layer in |
2593 | + * xdr_partial_copy_from_skb. |
2594 | + */ |
2595 | + if (!arg->pages) |
2596 | + return -ENOMEM; |
2597 | + return 0; |
2598 | +} |
2599 | |
2600 | /* |
2601 | * Public functions |
2602 | @@ -261,10 +281,16 @@ int gssp_accept_sec_context_upcall(struct net *net, |
2603 | arg.context_handle = &ctxh; |
2604 | res.output_token->len = GSSX_max_output_token_sz; |
2605 | |
2606 | + ret = gssp_alloc_receive_pages(&arg); |
2607 | + if (ret) |
2608 | + return ret; |
2609 | + |
2610 | /* use nfs/ for targ_name ? */ |
2611 | |
2612 | ret = gssp_call(net, &msg); |
2613 | |
2614 | + gssp_free_receive_pages(&arg); |
2615 | + |
2616 | /* we need to fetch all data even in case of error so |
2617 | * that we can free special strctures is they have been allocated */ |
2618 | data->major_status = res.status.major_status; |
2619 | diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c |
2620 | index 3c85d1c..f0f78c5 100644 |
2621 | --- a/net/sunrpc/auth_gss/gss_rpc_xdr.c |
2622 | +++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c |
2623 | @@ -166,14 +166,15 @@ static int dummy_dec_opt_array(struct xdr_stream *xdr, |
2624 | return 0; |
2625 | } |
2626 | |
2627 | -static int get_s32(void **p, void *max, s32 *res) |
2628 | +static int get_host_u32(struct xdr_stream *xdr, u32 *res) |
2629 | { |
2630 | - void *base = *p; |
2631 | - void *next = (void *)((char *)base + sizeof(s32)); |
2632 | - if (unlikely(next > max || next < base)) |
2633 | + __be32 *p; |
2634 | + |
2635 | + p = xdr_inline_decode(xdr, 4); |
2636 | + if (!p) |
2637 | return -EINVAL; |
2638 | - memcpy(res, base, sizeof(s32)); |
2639 | - *p = next; |
2640 | + /* Contents of linux creds are all host-endian: */ |
2641 | + memcpy(res, p, sizeof(u32)); |
2642 | return 0; |
2643 | } |
2644 | |
2645 | @@ -182,9 +183,9 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, |
2646 | { |
2647 | u32 length; |
2648 | __be32 *p; |
2649 | - void *q, *end; |
2650 | - s32 tmp; |
2651 | - int N, i, err; |
2652 | + u32 tmp; |
2653 | + u32 N; |
2654 | + int i, err; |
2655 | |
2656 | p = xdr_inline_decode(xdr, 4); |
2657 | if (unlikely(p == NULL)) |
2658 | @@ -192,33 +193,28 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, |
2659 | |
2660 | length = be32_to_cpup(p); |
2661 | |
2662 | - /* FIXME: we do not want to use the scratch buffer for this one |
2663 | - * may need to use functions that allows us to access an io vector |
2664 | - * directly */ |
2665 | - p = xdr_inline_decode(xdr, length); |
2666 | - if (unlikely(p == NULL)) |
2667 | + if (length > (3 + NGROUPS_MAX) * sizeof(u32)) |
2668 | return -ENOSPC; |
2669 | |
2670 | - q = p; |
2671 | - end = q + length; |
2672 | - |
2673 | /* uid */ |
2674 | - err = get_s32(&q, end, &tmp); |
2675 | + err = get_host_u32(xdr, &tmp); |
2676 | if (err) |
2677 | return err; |
2678 | creds->cr_uid = make_kuid(&init_user_ns, tmp); |
2679 | |
2680 | /* gid */ |
2681 | - err = get_s32(&q, end, &tmp); |
2682 | + err = get_host_u32(xdr, &tmp); |
2683 | if (err) |
2684 | return err; |
2685 | creds->cr_gid = make_kgid(&init_user_ns, tmp); |
2686 | |
2687 | /* number of additional gid's */ |
2688 | - err = get_s32(&q, end, &tmp); |
2689 | + err = get_host_u32(xdr, &tmp); |
2690 | if (err) |
2691 | return err; |
2692 | N = tmp; |
2693 | + if ((3 + N) * sizeof(u32) != length) |
2694 | + return -EINVAL; |
2695 | creds->cr_group_info = groups_alloc(N); |
2696 | if (creds->cr_group_info == NULL) |
2697 | return -ENOMEM; |
2698 | @@ -226,7 +222,7 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, |
2699 | /* gid's */ |
2700 | for (i = 0; i < N; i++) { |
2701 | kgid_t kgid; |
2702 | - err = get_s32(&q, end, &tmp); |
2703 | + err = get_host_u32(xdr, &tmp); |
2704 | if (err) |
2705 | goto out_free_groups; |
2706 | err = -EINVAL; |
2707 | @@ -784,6 +780,9 @@ void gssx_enc_accept_sec_context(struct rpc_rqst *req, |
2708 | /* arg->options */ |
2709 | err = dummy_enc_opt_array(xdr, &arg->options); |
2710 | |
2711 | + xdr_inline_pages(&req->rq_rcv_buf, |
2712 | + PAGE_SIZE/2 /* pretty arbitrary */, |
2713 | + arg->pages, 0 /* page base */, arg->npages * PAGE_SIZE); |
2714 | done: |
2715 | if (err) |
2716 | dprintk("RPC: gssx_enc_accept_sec_context: %d\n", err); |
2717 | diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.h b/net/sunrpc/auth_gss/gss_rpc_xdr.h |
2718 | index 1c98b27..685a688 100644 |
2719 | --- a/net/sunrpc/auth_gss/gss_rpc_xdr.h |
2720 | +++ b/net/sunrpc/auth_gss/gss_rpc_xdr.h |
2721 | @@ -147,6 +147,8 @@ struct gssx_arg_accept_sec_context { |
2722 | struct gssx_cb *input_cb; |
2723 | u32 ret_deleg_cred; |
2724 | struct gssx_option_array options; |
2725 | + struct page **pages; |
2726 | + unsigned int npages; |
2727 | }; |
2728 | |
2729 | struct gssx_res_accept_sec_context { |
2730 | @@ -240,7 +242,8 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, |
2731 | 2 * GSSX_max_princ_sz + \ |
2732 | 8 + 8 + 4 + 4 + 4) |
2733 | #define GSSX_max_output_token_sz 1024 |
2734 | -#define GSSX_max_creds_sz (4 + 4 + 4 + NGROUPS_MAX * 4) |
2735 | +/* grouplist not included; we allocate separate pages for that: */ |
2736 | +#define GSSX_max_creds_sz (4 + 4 + 4 /* + NGROUPS_MAX*4 */) |
2737 | #define GSSX_RES_accept_sec_context_sz (GSSX_default_status_sz + \ |
2738 | GSSX_default_ctx_sz + \ |
2739 | GSSX_max_output_token_sz + \ |
2740 | diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c |
2741 | index 6fcb9de..8bcdf9e 100644 |
2742 | --- a/tools/perf/util/map.c |
2743 | +++ b/tools/perf/util/map.c |
2744 | @@ -21,6 +21,7 @@ const char *map_type__name[MAP__NR_TYPES] = { |
2745 | static inline int is_anon_memory(const char *filename) |
2746 | { |
2747 | return !strcmp(filename, "//anon") || |
2748 | + !strcmp(filename, "/dev/zero (deleted)") || |
2749 | !strcmp(filename, "/anon_hugepage (deleted)"); |
2750 | } |
2751 |