13 files changed, 261 insertions, 100 deletions

diff --git a/drivers/mtd/ubi/Kconfig b/drivers/mtd/ubi/Kconfig
index b1cd7a1a2191..0a8c7ea764ae 100644
--- a/drivers/mtd/ubi/Kconfig
+++ b/drivers/mtd/ubi/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/ubi/Kconfig
-
 menu "UBI - Unsorted block images"
         depends on MTD
 
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 14cec04c34f9..55c726dde942 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -37,12 +37,14 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/stringify.h>
+#include <linux/namei.h>
 #include <linux/stat.h>
 #include <linux/miscdevice.h>
 #include <linux/log2.h>
 #include <linux/kthread.h>
 #include <linux/reboot.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include "ubi.h"
 
 /* Maximum length of the 'mtd=' parameter */
@@ -50,7 +52,8 @@
 
 /**
  * struct mtd_dev_param - MTD device parameter description data structure.
- * @name: MTD device name or number string
+ * @name: MTD character device node path, MTD device name, or MTD device number
+ *        string
  * @vid_hdr_offs: VID header offset
  */
 struct mtd_dev_param {
@@ -59,10 +62,10 @@ struct mtd_dev_param {
 };
 
 /* Numbers of elements set in the @mtd_dev_param array */
-static int mtd_devs;
+static int __initdata mtd_devs;
 
 /* MTD devices specification parameters */
-static struct mtd_dev_param mtd_dev_param[UBI_MAX_DEVICES];
+static struct mtd_dev_param __initdata mtd_dev_param[UBI_MAX_DEVICES];
 
 /* Root UBI "class" object (corresponds to '/<sysfs>/class/ubi/') */
 struct class *ubi_class;
@@ -87,7 +90,8 @@ DEFINE_MUTEX(ubi_devices_mutex);
 static DEFINE_SPINLOCK(ubi_devices_lock);
 
 /* "Show" method for files in '/<sysfs>/class/ubi/' */
-static ssize_t ubi_version_show(struct class *class, char *buf)
+static ssize_t ubi_version_show(struct class *class, struct class_attribute *attr,
+                                char *buf)
 {
         return sprintf(buf, "%d\n", UBI_VERSION);
 }
@@ -363,11 +367,13 @@ static void dev_release(struct device *dev)
 /**
  * ubi_sysfs_init - initialize sysfs for an UBI device.
  * @ubi: UBI device description object
+ * @ref: set to %1 on exit in case of failure if a reference to @ubi->dev was
+ *       taken
  *
  * This function returns zero in case of success and a negative error code in
  * case of failure.
  */
-static int ubi_sysfs_init(struct ubi_device *ubi)
+static int ubi_sysfs_init(struct ubi_device *ubi, int *ref)
 {
         int err;
 
@@ -379,6 +385,7 @@ static int ubi_sysfs_init(struct ubi_device *ubi)
         if (err)
                 return err;
 
+        *ref = 1;
         err = device_create_file(&ubi->dev, &dev_eraseblock_size);
         if (err)
                 return err;
@@ -434,7 +441,7 @@ static void ubi_sysfs_close(struct ubi_device *ubi)
 }
 
 /**
- * kill_volumes - destroy all volumes.
+ * kill_volumes - destroy all user volumes.
  * @ubi: UBI device description object
  */
 static void kill_volumes(struct ubi_device *ubi)
@@ -447,36 +454,29 @@ static void kill_volumes(struct ubi_device *ubi)
 }
 
 /**
- * free_user_volumes - free all user volumes.
- * @ubi: UBI device description object
- *
- * Normally the volumes are freed at the release function of the volume device
- * objects. However, on error paths the volumes have to be freed before the
- * device objects have been initialized.
- */
-static void free_user_volumes(struct ubi_device *ubi)
-{
-        int i;
-
-        for (i = 0; i < ubi->vtbl_slots; i++)
-                if (ubi->volumes[i]) {
-                        kfree(ubi->volumes[i]->eba_tbl);
-                        kfree(ubi->volumes[i]);
-                }
-}
-
-/**
  * uif_init - initialize user interfaces for an UBI device.
  * @ubi: UBI device description object
+ * @ref: set to %1 on exit in case of failure if a reference to @ubi->dev was
+ *       taken, otherwise set to %0
+ *
+ * This function initializes various user interfaces for an UBI device. If the
+ * initialization fails at an early stage, this function frees all the
+ * resources it allocated, returns an error, and @ref is set to %0. However,
+ * if the initialization fails after the UBI device was registered in the
+ * driver core subsystem, this function takes a reference to @ubi->dev, because
+ * otherwise the release function ('dev_release()') would free whole @ubi
+ * object. The @ref argument is set to %1 in this case. The caller has to put
+ * this reference.
  *
  * This function returns zero in case of success and a negative error code in
- * case of failure. Note, this function destroys all volumes if it fails.
+ * case of failure.
  */
-static int uif_init(struct ubi_device *ubi)
+static int uif_init(struct ubi_device *ubi, int *ref)
 {
         int i, err;
         dev_t dev;
 
+        *ref = 0;
         sprintf(ubi->ubi_name, UBI_NAME_STR "%d", ubi->ubi_num);
 
         /*
@@ -504,7 +504,7 @@ static int uif_init(struct ubi_device *ubi)
                 goto out_unreg;
         }
 
-        err = ubi_sysfs_init(ubi);
+        err = ubi_sysfs_init(ubi, ref);
         if (err)
                 goto out_sysfs;
 
@@ -522,6 +522,8 @@ static int uif_init(struct ubi_device *ubi)
 out_volumes:
         kill_volumes(ubi);
 out_sysfs:
+        if (*ref)
+                get_device(&ubi->dev);
         ubi_sysfs_close(ubi);
         cdev_del(&ubi->cdev);
 out_unreg:
@@ -875,7 +877,7 @@ static int ubi_reboot_notifier(struct notifier_block *n, unsigned long state,
 int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
 {
         struct ubi_device *ubi;
-        int i, err, do_free = 1;
+        int i, err, ref = 0;
 
         /*
          * Check if we already have the same MTD device attached.
@@ -975,9 +977,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
                         goto out_detach;
         }
 
-        err = uif_init(ubi);
+        err = uif_init(ubi, &ref);
         if (err)
-                goto out_nofree;
+                goto out_detach;
 
         ubi->bgt_thread = kthread_create(ubi_thread, ubi, ubi->bgt_name);
         if (IS_ERR(ubi->bgt_thread)) {
@@ -1025,12 +1027,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
 
 out_uif:
         uif_close(ubi);
-out_nofree:
-        do_free = 0;
 out_detach:
         ubi_wl_close(ubi);
-        if (do_free)
-                free_user_volumes(ubi);
         free_internal_volumes(ubi);
         vfree(ubi->vtbl);
 out_free:
@@ -1039,7 +1037,10 @@ out_free:
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
         vfree(ubi->dbg_peb_buf);
 #endif
-        kfree(ubi);
+        if (ref)
+                put_device(&ubi->dev);
+        else
+                kfree(ubi);
         return err;
 }
 
@@ -1096,7 +1097,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
 
         /*
          * Get a reference to the device in order to prevent 'dev_release()'
-         * from freeing @ubi object.
+         * from freeing the @ubi object.
          */
         get_device(&ubi->dev);
 
@@ -1116,13 +1117,50 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
 }
 
 /**
- * find_mtd_device - open an MTD device by its name or number.
- * @mtd_dev: name or number of the device
+ * open_mtd_by_chdev - open an MTD device by its character device node path.
+ * @mtd_dev: MTD character device node path
+ *
+ * This helper function opens an MTD device by its character node device path.
+ * Returns MTD device description object in case of success and a negative
+ * error code in case of failure.
+ */
+static struct mtd_info * __init open_mtd_by_chdev(const char *mtd_dev)
+{
+        int err, major, minor, mode;
+        struct path path;
+
+        /* Probably this is an MTD character device node path */
+        err = kern_path(mtd_dev, LOOKUP_FOLLOW, &path);
+        if (err)
+                return ERR_PTR(err);
+
+        /* MTD device number is defined by the major / minor numbers */
+        major = imajor(path.dentry->d_inode);
+        minor = iminor(path.dentry->d_inode);
+        mode = path.dentry->d_inode->i_mode;
+        path_put(&path);
+        if (major != MTD_CHAR_MAJOR || !S_ISCHR(mode))
+                return ERR_PTR(-EINVAL);
+
+        if (minor & 1)
+                /*
+                 * Just do not think the "/dev/mtdrX" devices support is need,
+                 * so do not support them to avoid doing extra work.
+                 */
+                return ERR_PTR(-EINVAL);
+
+        return get_mtd_device(NULL, minor / 2);
+}
+
+/**
+ * open_mtd_device - open MTD device by name, character device path, or number.
+ * @mtd_dev: name, character device node path, or MTD device device number
  *
  * This function tries to open and MTD device described by @mtd_dev string,
- * which is first treated as an ASCII number, and if it is not true, it is
- * treated as MTD device name. Returns MTD device description object in case of
- * success and a negative error code in case of failure.
+ * which is first treated as ASCII MTD device number, and if it is not true, it
+ * is treated as MTD device name, and if that is also not true, it is treated
+ * as MTD character device node path. Returns MTD device description object in
+ * case of success and a negative error code in case of failure.
  */
 static struct mtd_info * __init open_mtd_device(const char *mtd_dev)
 {
@@ -1137,6 +1175,9 @@ static struct mtd_info * __init open_mtd_device(const char *mtd_dev)
                  * MTD device name.
                  */
                 mtd = get_mtd_device_nm(mtd_dev);
+                if (IS_ERR(mtd) && PTR_ERR(mtd) == -ENODEV)
+                        /* Probably this is an MTD character device node path */
+                        mtd = open_mtd_by_chdev(mtd_dev);
         } else
                 mtd = get_mtd_device(NULL, mtd_num);
 
@@ -1352,13 +1393,15 @@ static int __init ubi_mtd_param_parse(const char *val, struct kernel_param *kp)
 
 module_param_call(mtd, ubi_mtd_param_parse, NULL, NULL, 000);
 MODULE_PARM_DESC(mtd, "MTD devices to attach. Parameter format: "
-                      "mtd=<name|num>[,<vid_hdr_offs>].\n"
+                      "mtd=<name|num|path>[,<vid_hdr_offs>].\n"
                       "Multiple \"mtd\" parameters may be specified.\n"
-                      "MTD devices may be specified by their number or name.\n"
+                      "MTD devices may be specified by their number, name, or "
+                      "path to the MTD character device node.\n"
                       "Optional \"vid_hdr_offs\" parameter specifies UBI VID "
-                      "header position and data starting position to be used "
-                      "by UBI.\n"
-                      "Example: mtd=content,1984 mtd=4 - attach MTD device"
+                      "header position to be used by UBI.\n"
+                      "Example 1: mtd=/dev/mtd0 - attach MTD device "
+                      "/dev/mtd0.\n"
+                      "Example 2: mtd=content,1984 mtd=4 - attach MTD device "
                       "with name \"content\" using VID header offset 1984, and "
                       "MTD device number 4 with default VID header offset.");
 
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index f237ddbb2713..72ebb3f06b86 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -37,6 +37,7 @@
 
 #include <linux/module.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/ioctl.h>
 #include <linux/capability.h>
 #include <linux/uaccess.h>
@@ -853,7 +854,6 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                         break;
                 }
 
-                req.name[req.name_len] = '\0';
                 err = verify_mkvol_req(ubi, &req);
                 if (err)
                         break;
diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
index f30bcb372c05..17a107129726 100644
--- a/drivers/mtd/ubi/debug.h
+++ b/drivers/mtd/ubi/debug.h
@@ -96,8 +96,11 @@ void ubi_dbg_dump_flash(struct ubi_device *ubi, int pnum, int offset, int len);
 
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
 int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len);
+int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+                        int offset, int len);
 #else
 #define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+#define ubi_dbg_check_write(ubi, buf, pnum, offset, len) 0
 #endif
 
 #ifdef CONFIG_MTD_UBI_DEBUG_DISABLE_BGT
@@ -176,6 +179,7 @@ static inline int ubi_dbg_is_erase_failure(void)
 #define ubi_dbg_is_write_failure() 0
 #define ubi_dbg_is_erase_failure() 0
 #define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+#define ubi_dbg_check_write(ubi, buf, pnum, offset, len) 0
 
 #endif /* !CONFIG_MTD_UBI_DEBUG */
 #endif /* !__UBI_DEBUG_H__ */
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index b5e478fa2661..9aa81584c8a2 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -31,6 +31,7 @@
 
 #include <linux/err.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/math64.h>
 #include <linux/module.h>
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index 8aa51e7a6a7d..533b1a4b9af1 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -88,6 +88,7 @@
 
 #include <linux/crc32.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include "ubi.h"
 
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -143,7 +144,7 @@ int ubi_io_read(const struct ubi_device *ubi, void *buf, int pnum, int offset,
 
         err = paranoid_check_not_bad(ubi, pnum);
         if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
 
         addr = (loff_t)pnum * ubi->peb_size + offset;
 retry:
@@ -236,12 +237,12 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
 
         err = paranoid_check_not_bad(ubi, pnum);
         if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
 
         /* The area we are writing to has to contain all 0xFF bytes */
         err = ubi_dbg_check_all_ff(ubi, pnum, offset, len);
         if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
 
         if (offset >= ubi->leb_start) {
                 /*
@@ -250,10 +251,10 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
                  */
                 err = paranoid_check_peb_ec_hdr(ubi, pnum);
                 if (err)
-                        return err > 0 ? -EINVAL : err;
+                        return err;
                 err = paranoid_check_peb_vid_hdr(ubi, pnum);
                 if (err)
-                        return err > 0 ? -EINVAL : err;
+                        return err;
         }
 
         if (ubi_dbg_is_write_failure()) {
@@ -273,6 +274,21 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
         } else
                 ubi_assert(written == len);
 
+        if (!err) {
+                err = ubi_dbg_check_write(ubi, buf, pnum, offset, len);
+                if (err)
+                        return err;
+
+                /*
+                 * Since we always write sequentially, the rest of the PEB has
+                 * to contain only 0xFF bytes.
+                 */
+                offset += len;
+                len = ubi->peb_size - offset;
+                if (len)
+                        err = ubi_dbg_check_all_ff(ubi, pnum, offset, len);
+        }
+
         return err;
 }
 
@@ -348,7 +364,7 @@ retry:
 
         err = ubi_dbg_check_all_ff(ubi, pnum, 0, ubi->peb_size);
         if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
 
         if (ubi_dbg_is_erase_failure() && !err) {
                 dbg_err("cannot erase PEB %d (emulated)", pnum);
@@ -542,7 +558,7 @@ int ubi_io_sync_erase(struct ubi_device *ubi, int pnum, int torture)
 
         err = paranoid_check_not_bad(ubi, pnum);
         if (err != 0)
-                return err > 0 ? -EINVAL : err;
+                return err;
 
         if (ubi->ro_mode) {
                 ubi_err("read-only mode");
@@ -819,7 +835,7 @@ int ubi_io_write_ec_hdr(struct ubi_device *ubi, int pnum,
 
         err = paranoid_check_ec_hdr(ubi, pnum, ec_hdr);
         if (err)
-                return -EINVAL;
+                return err;
 
         err = ubi_io_write(ubi, ec_hdr, pnum, 0, ubi->ec_hdr_alsize);
         return err;
@@ -1083,7 +1099,7 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
 
         err = paranoid_check_peb_ec_hdr(ubi, pnum);
         if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
 
         vid_hdr->magic = cpu_to_be32(UBI_VID_HDR_MAGIC);
         vid_hdr->version = UBI_VERSION;
@@ -1092,7 +1108,7 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
 
         err = paranoid_check_vid_hdr(ubi, pnum, vid_hdr);
         if (err)
-                return -EINVAL;
+                return err;
 
         p = (char *)vid_hdr - ubi->vid_hdr_shift;
         err = ubi_io_write(ubi, p, pnum, ubi->vid_hdr_aloffset,
@@ -1107,8 +1123,8 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
  * @ubi: UBI device description object
  * @pnum: physical eraseblock number to check
  *
- * This function returns zero if the physical eraseblock is good, a positive
- * number if it is bad and a negative error code if an error occurred.
+ * This function returns zero if the physical eraseblock is good, %-EINVAL if
+ * it is bad and a negative error code if an error occurred.
  */
 static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
 {
@@ -1120,7 +1136,7 @@ static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
 
         ubi_err("paranoid check failed for PEB %d", pnum);
         ubi_dbg_dump_stack();
-        return err;
+        return err > 0 ? -EINVAL : err;
 }
 
 /**
@@ -1130,7 +1146,7 @@ static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
  * @ec_hdr: the erase counter header to check
  *
  * This function returns zero if the erase counter header contains valid
- * values, and %1 if not.
+ * values, and %-EINVAL if not.
  */
 static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
                                  const struct ubi_ec_hdr *ec_hdr)
@@ -1156,7 +1172,7 @@ static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
 fail:
         ubi_dbg_dump_ec_hdr(ec_hdr);
         ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 
 /**
@@ -1164,8 +1180,8 @@ fail:
  * @ubi: UBI device description object
  * @pnum: the physical eraseblock number to check
  *
- * This function returns zero if the erase counter header is all right, %1 if
- * not, and a negative error code if an error occurred.
+ * This function returns zero if the erase counter header is all right and and
+ * a negative error code if not or if an error occurred.
  */
 static int paranoid_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum)
 {
@@ -1188,7 +1204,7 @@ static int paranoid_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum)
                 ubi_err("paranoid check failed for PEB %d", pnum);
                 ubi_dbg_dump_ec_hdr(ec_hdr);
                 ubi_dbg_dump_stack();
-                err = 1;
+                err = -EINVAL;
                 goto exit;
         }
 
@@ -1206,7 +1222,7 @@ exit:
  * @vid_hdr: the volume identifier header to check
  *
  * This function returns zero if the volume identifier header is all right, and
- * %1 if not.
+ * %-EINVAL if not.
  */
 static int paranoid_check_vid_hdr(const struct ubi_device *ubi, int pnum,
                                   const struct ubi_vid_hdr *vid_hdr)
@@ -1233,7 +1249,7 @@ fail:
         ubi_err("paranoid check failed for PEB %d", pnum);
         ubi_dbg_dump_vid_hdr(vid_hdr);
         ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 
 }
 
@@ -1243,7 +1259,7 @@ fail:
  * @pnum: the physical eraseblock number to check
  *
  * This function returns zero if the volume identifier header is all right,
- * %1 if not, and a negative error code if an error occurred.
+ * and a negative error code if not or if an error occurred.
  */
 static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
 {
@@ -1270,7 +1286,7 @@ static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
                 ubi_err("paranoid check failed for PEB %d", pnum);
                 ubi_dbg_dump_vid_hdr(vid_hdr);
                 ubi_dbg_dump_stack();
-                err = 1;
+                err = -EINVAL;
                 goto exit;
         }
 
@@ -1282,6 +1298,61 @@ exit:
 }
 
 /**
+ * ubi_dbg_check_write - make sure write succeeded.
+ * @ubi: UBI device description object
+ * @buf: buffer with data which were written
+ * @pnum: physical eraseblock number the data were written to
+ * @offset: offset within the physical eraseblock the data were written to
+ * @len: how many bytes were written
+ *
+ * This functions reads data which were recently written and compares it with
+ * the original data buffer - the data have to match. Returns zero if the data
+ * match and a negative error code if not or in case of failure.
+ */
+int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+                        int offset, int len)
+{
+        int err, i;
+
+        mutex_lock(&ubi->dbg_buf_mutex);
+        err = ubi_io_read(ubi, ubi->dbg_peb_buf, pnum, offset, len);
+        if (err)
+                goto out_unlock;
+
+        for (i = 0; i < len; i++) {
+                uint8_t c = ((uint8_t *)buf)[i];
+                uint8_t c1 = ((uint8_t *)ubi->dbg_peb_buf)[i];
+                int dump_len;
+
+                if (c == c1)
+                        continue;
+
+                ubi_err("paranoid check failed for PEB %d:%d, len %d",
+                        pnum, offset, len);
+                ubi_msg("data differ at position %d", i);
+                dump_len = max_t(int, 128, len - i);
+                ubi_msg("hex dump of the original buffer from %d to %d",
+                        i, i + dump_len);
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+                               buf + i, dump_len, 1);
+                ubi_msg("hex dump of the read buffer from %d to %d",
+                        i, i + dump_len);
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+                               ubi->dbg_peb_buf + i, dump_len, 1);
+                ubi_dbg_dump_stack();
+                err = -EINVAL;
+                goto out_unlock;
+        }
+        mutex_unlock(&ubi->dbg_buf_mutex);
+
+        return 0;
+
+out_unlock:
+        mutex_unlock(&ubi->dbg_buf_mutex);
+        return err;
+}
+
+/**
  * ubi_dbg_check_all_ff - check that a region of flash is empty.
  * @ubi: UBI device description object
  * @pnum: the physical eraseblock number to check
@@ -1289,8 +1360,8 @@ exit:
  * @len: the length of the region to check
  *
  * This function returns zero if only 0xFF bytes are present at offset
- * @offset of the physical eraseblock @pnum, %1 if not, and a negative error
- * code if an error occurred.
+ * @offset of the physical eraseblock @pnum, and a negative error code if not
+ * or if an error occurred.
  */
 int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len)
 {
@@ -1321,7 +1392,7 @@ fail:
         ubi_msg("hex dump of the %d-%d region", offset, offset + len);
         print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
                        ubi->dbg_peb_buf, len, 1);
-        err = 1;
+        err = -EINVAL;
 error:
         ubi_dbg_dump_stack();
         mutex_unlock(&ubi->dbg_buf_mutex);
diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
index 88a72e9c8beb..17f287decc36 100644
--- a/drivers/mtd/ubi/kapi.c
+++ b/drivers/mtd/ubi/kapi.c
@@ -22,6 +22,9 @@
 
 #include <linux/module.h>
 #include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/namei.h>
+#include <linux/fs.h>
 #include <asm/div64.h>
 #include "ubi.h"
 
@@ -280,6 +283,43 @@ struct ubi_volume_desc *ubi_open_volume_nm(int ubi_num, const char *name,
 EXPORT_SYMBOL_GPL(ubi_open_volume_nm);
 
 /**
+ * ubi_open_volume_path - open UBI volume by its character device node path.
+ * @pathname: volume character device node path
+ * @mode: open mode
+ *
+ * This function is similar to 'ubi_open_volume()', but opens a volume the path
+ * to its character device node.
+ */
+struct ubi_volume_desc *ubi_open_volume_path(const char *pathname, int mode)
+{
+        int error, ubi_num, vol_id, mod;
+        struct inode *inode;
+        struct path path;
+
+        dbg_gen("open volume %s, mode %d", pathname, mode);
+
+        if (!pathname || !*pathname)
+                return ERR_PTR(-EINVAL);
+
+        error = kern_path(pathname, LOOKUP_FOLLOW, &path);
+        if (error)
+                return ERR_PTR(error);
+
+        inode = path.dentry->d_inode;
+        mod = inode->i_mode;
+        ubi_num = ubi_major2num(imajor(inode));
+        vol_id = iminor(inode) - 1;
+        path_put(&path);
+
+        if (!S_ISCHR(mod))
+                return ERR_PTR(-EINVAL);
+        if (vol_id >= 0 && ubi_num >= 0)
+                return ubi_open_volume(ubi_num, vol_id, mode);
+        return ERR_PTR(-ENODEV);
+}
+EXPORT_SYMBOL_GPL(ubi_open_volume_path);
+
+/**
  * ubi_close_volume - close UBI volume.
  * @desc: volume descriptor
  */
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 90af61a2c3e4..dc5f688699da 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -41,6 +41,7 @@
  */
 
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/crc32.h>
 #include <linux/math64.h>
 #include "ubi.h"
@@ -974,11 +975,8 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
                         seb->ec = si->mean_ec;
 
         err = paranoid_check_si(ubi, si);
-        if (err) {
-                if (err > 0)
-                        err = -EINVAL;
+        if (err)
                 goto out_vidh;
-        }
 
         ubi_free_vid_hdr(ubi, vidh);
         kfree(ech);
@@ -1086,8 +1084,8 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si)
  * @ubi: UBI device description object
  * @si: scanning information
  *
- * This function returns zero if the scanning information is all right, %1 if
- * not and a negative error code if an error occurred.
+ * This function returns zero if the scanning information is all right, and a
+ * negative error code if not or if an error occurred.
  */
 static int paranoid_check_si(struct ubi_device *ubi, struct ubi_scan_info *si)
 {
@@ -1346,7 +1344,7 @@ bad_vid_hdr:
 
 out:
         ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 
 #endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 1af08178defd..5176d4886518 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -34,6 +34,7 @@
 #include <linux/fs.h>
 #include <linux/cdev.h>
 #include <linux/device.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/vmalloc.h>
 #include <linux/notifier.h>
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 74fdc40c8627..425bf5a3edd4 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -147,12 +147,15 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
         }
 
         if (bytes == 0) {
+                err = ubi_wl_flush(ubi);
+                if (err)
+                        return err;
+
                 err = clear_update_marker(ubi, vol, 0);
                 if (err)
                         return err;
-                err = ubi_wl_flush(ubi);
-                if (!err)
-                        vol->updating = 0;
+                vol->updating = 0;
+                return 0;
         }
 
         vol->upd_buf = vmalloc(ubi->leb_size);
@@ -362,16 +365,16 @@ int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
 
         ubi_assert(vol->upd_received <= vol->upd_bytes);
         if (vol->upd_received == vol->upd_bytes) {
+                err = ubi_wl_flush(ubi);
+                if (err)
+                        return err;
                 /* The update is finished, clear the update marker */
                 err = clear_update_marker(ubi, vol, vol->upd_bytes);
                 if (err)
                         return err;
-                err = ubi_wl_flush(ubi);
-                if (err == 0) {
-                        vol->updating = 0;
-                        err = to_write;
-                        vfree(vol->upd_buf);
-                }
+                vol->updating = 0;
+                err = to_write;
+                vfree(vol->upd_buf);
         }
 
         return err;
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index ab64cb56df6e..e42afab9a9fe 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -25,6 +25,7 @@
 
 #include <linux/err.h>
 #include <linux/math64.h>
+#include <linux/slab.h>
 #include "ubi.h"
 
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 1afc61e7455d..cd90ff3b76b1 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -58,6 +58,7 @@
 
 #include <linux/crc32.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <asm/div64.h>
 #include "ubi.h"
 
@@ -566,6 +567,7 @@ static int init_volumes(struct ubi_device *ubi, const struct ubi_scan_info *si,
                 vol->reserved_pebs = be32_to_cpu(vtbl[i].reserved_pebs);
                 vol->alignment = be32_to_cpu(vtbl[i].alignment);
                 vol->data_pad = be32_to_cpu(vtbl[i].data_pad);
+                vol->upd_marker = vtbl[i].upd_marker;
                 vol->vol_type = vtbl[i].vol_type == UBI_VID_DYNAMIC ?
                                         UBI_DYNAMIC_VOLUME : UBI_STATIC_VOLUME;
                 vol->name_len = be16_to_cpu(vtbl[i].name_len);
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 600c7229d5cf..f64ddabd4ac8 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -464,7 +464,7 @@ retry:
                                    ubi->peb_size - ubi->vid_hdr_aloffset);
         if (err) {
                 ubi_err("new PEB %d does not contain all 0xFF bytes", e->pnum);
-                return err > 0 ? -EINVAL : err;
+                return err;
         }
 
         return e->pnum;
@@ -513,7 +513,7 @@ static int sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
         dbg_wl("erase PEB %d, old EC %llu", e->pnum, ec);
 
         err = paranoid_check_ec(ubi, e->pnum, e->ec);
-        if (err > 0)
+        if (err)
                 return -EINVAL;
 
         ec_hdr = kzalloc(ubi->ec_hdr_alsize, GFP_NOFS);
@@ -1572,8 +1572,7 @@ void ubi_wl_close(struct ubi_device *ubi)
  * @ec: the erase counter to check
  *
  * This function returns zero if the erase counter of physical eraseblock @pnum
- * is equivalent to @ec, %1 if not, and a negative error code if an error
- * occurred.
+ * is equivalent to @ec, and a negative error code if not or if an error occurred.
  */
 static int paranoid_check_ec(struct ubi_device *ubi, int pnum, int ec)
 {
@@ -1611,8 +1610,8 @@ out_free:
  * @e: the wear-leveling entry to check
  * @root: the root of the tree
  *
- * This function returns zero if @e is in the @root RB-tree and %1 if it is
- * not.
+ * This function returns zero if @e is in the @root RB-tree and %-EINVAL if it
+ * is not.
  */
 static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
                                      struct rb_root *root)
@@ -1623,7 +1622,7 @@ static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
         ubi_err("paranoid check failed for PEB %d, EC %d, RB-tree %p ",
                 e->pnum, e->ec, root);
         ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 
 /**
@@ -1632,7 +1631,7 @@ static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
  * @ubi: UBI device description object
  * @e: the wear-leveling entry to check
  *
- * This function returns zero if @e is in @ubi->pq and %1 if it is not.
+ * This function returns zero if @e is in @ubi->pq and %-EINVAL if it is not.
  */
 static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e)
 {
@@ -1647,6 +1646,6 @@ static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e)
         ubi_err("paranoid check failed for PEB %d, EC %d, Protect queue",
                 e->pnum, e->ec);
         ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 #endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */