Merge branch 'wip-2.6.34' into old-private-masterarchived-private-master

3 files changed, 86 insertions, 62 deletions

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 49d8495d69be..280529ad9274 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -243,6 +243,39 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
         input_sync(dev);
 }
 
+static int __hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("session %p data %p size %d", session, data, size);
+
+        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        *skb_put(skb, 1) = hdr;
+        if (data && size > 0)
+                memcpy(skb_put(skb, size), data, size);
+
+        skb_queue_tail(&session->ctrl_transmit, skb);
+
+        return 0;
+}
+
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        int err;
+
+        err = __hidp_send_ctrl_message(session, hdr, data, size);
+
+        hidp_schedule(session);
+
+        return err;
+}
+
 static int hidp_queue_report(struct hidp_session *session,
                                 unsigned char *data, int size)
 {
@@ -280,6 +313,26 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
         return hidp_queue_report(session, buf, rsize);
 }
 
+static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
+                unsigned char report_type)
+{
+        switch (report_type) {
+        case HID_FEATURE_REPORT:
+                report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
+                break;
+        case HID_OUTPUT_REPORT:
+                report_type = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (hidp_send_ctrl_message(hid->driver_data, report_type,
+                        data, count))
+                return -ENOMEM;
+        return count;
+}
+
 static void hidp_idle_timeout(unsigned long arg)
 {
         struct hidp_session *session = (struct hidp_session *) arg;
@@ -300,39 +353,6 @@ static inline void hidp_del_timer(struct hidp_session *session)
                 del_timer(&session->timer);
 }
 
-static int __hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        struct sk_buff *skb;
-
-        BT_DBG("session %p data %p size %d", session, data, size);
-
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
-                BT_ERR("Can't allocate memory for new frame");
-                return -ENOMEM;
-        }
-
-        *skb_put(skb, 1) = hdr;
-        if (data && size > 0)
-                memcpy(skb_put(skb, size), data, size);
-
-        skb_queue_tail(&session->ctrl_transmit, skb);
-
-        return 0;
-}
-
-static inline int hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        int err;
-
-        err = __hidp_send_ctrl_message(session, hdr, data, size);
-
-        hidp_schedule(session);
-
-        return err;
-}
-
 static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
@@ -694,29 +714,9 @@ static void hidp_close(struct hid_device *hid)
 static int hidp_parse(struct hid_device *hid)
 {
         struct hidp_session *session = hid->driver_data;
-        struct hidp_connadd_req *req = session->req;
-        unsigned char *buf;
-        int ret;
-
-        buf = kmalloc(req->rd_size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        if (copy_from_user(buf, req->rd_data, req->rd_size)) {
-                kfree(buf);
-                return -EFAULT;
-        }
-
-        ret = hid_parse_report(session->hid, buf, req->rd_size);
-
-        kfree(buf);
-
-        if (ret)
-                return ret;
 
-        session->req = NULL;
-
-        return 0;
+        return hid_parse_report(session->hid, session->rd_data,
+                        session->rd_size);
 }
 
 static int hidp_start(struct hid_device *hid)
@@ -761,12 +761,24 @@ static int hidp_setup_hid(struct hidp_session *session,
         bdaddr_t src, dst;
         int err;
 
+        session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
+        if (!session->rd_data)
+                return -ENOMEM;
+
+        if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
+                err = -EFAULT;
+                goto fault;
+        }
+        session->rd_size = req->rd_size;
+
         hid = hid_allocate_device();
-        if (IS_ERR(hid))
-                return PTR_ERR(session->hid);
+        if (IS_ERR(hid)) {
+                err = PTR_ERR(hid);
+                goto fault;
+        }
 
         session->hid = hid;
-        session->req = req;
+
         hid->driver_data = session;
 
         baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
@@ -785,6 +797,8 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->dev.parent = hidp_get_device(session);
         hid->ll_driver = &hidp_hid_driver;
 
+        hid->hid_output_raw_report = hidp_output_raw_report;
+
         err = hid_add_device(hid);
         if (err < 0)
                 goto failed;
@@ -795,6 +809,10 @@ failed:
         hid_destroy_device(hid);
         session->hid = NULL;
 
+fault:
+        kfree(session->rd_data);
+        session->rd_data = NULL;
+
         return err;
 }
 
@@ -889,6 +907,9 @@ unlink:
                 session->hid = NULL;
         }
 
+        kfree(session->rd_data);
+        session->rd_data = NULL;
+
 purge:
         skb_queue_purge(&session->ctrl_transmit);
         skb_queue_purge(&session->intr_transmit);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index faf3d74c3586..a4e215d50c10 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -154,7 +154,9 @@ struct hidp_session {
         struct sk_buff_head ctrl_transmit;
         struct sk_buff_head intr_transmit;
 
-        struct hidp_connadd_req *req;
+        /* Report descriptor */
+        __u8 *rd_data;
+        uint rd_size;
 };
 
 static inline void hidp_schedule(struct hidp_session *session)
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 37c9d7d2e688..250dfd46237d 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -26,7 +26,6 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fcntl.h>
 #include <linux/skbuff.h>
@@ -35,6 +34,7 @@
 #include <linux/file.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/gfp.h>
 #include <net/sock.h>
 
 #include "hidp.h"
@@ -241,7 +241,8 @@ static struct proto hidp_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
+static int hidp_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -268,7 +269,7 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family hidp_sock_family_ops = {
+static const struct net_proto_family hidp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hidp_sock_create