[ 191.310008] WARNING: kmemcheck: Caught 32-bit read from freed memory (f0d25f14)
[ 191.310011] c056d2f088000000105fd2f00000000050415353040000000000000000000000
[ 191.310020] i i i i f f f f f f f f f f f f f f f f f f f f f f f f f f f f
[ 191.310027] ^
[ 191.310029]
[ 191.310032] Pid: 737, comm: modprobe Not tainted 3.0.0-rc5+ #268 Hewlett-Packard HP Compaq 6005 Pro SFF PC/3047h
[ 191.310036] EIP: 0060:[<f80b3104>] EFLAGS: 00010286 CPU: 0
[ 191.310039] EIP is at hp_wmi_perform_query+0x104/0x150 [hp_wmi]
[ 191.310041] EAX: f0d25601 EBX: f0d25f00 ECX: 000121cf EDX: 000121ce
[ 191.310043] ESI: f0d25f10 EDI: f0f97ea8 EBP: f0f97ec4 ESP: c173f34c
[ 191.310045] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 191.310046] CR0: 8005003b CR2: f540c000 CR3: 30f30000 CR4: 000006d0
[ 191.310048] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 191.310050] DR6: ffff4ff0 DR7: 00000400
[ 191.310051] [<f80b317b>] hp_wmi_dock_state+0x2b/0x40 [hp_wmi]
[ 191.310054] [<f80b6093>] hp_wmi_init+0x93/0x1a8 [hp_wmi]
[ 191.310057] [<c10011f0>] do_one_initcall+0x30/0x170
[ 191.310061] [<c107ab9f>] sys_init_module+0xef/0x1a60
[ 191.310064] [<c149f998>] sysenter_do_call+0x12/0x28
[ 191.310067] [<ffffffff>] 0xffffffff
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Added pr_fmt and converted printks to pr_<level>.
Removed now unused PREFIX and UNIMPL #defines.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Some recent HP laptops use a new wireless query command type 0x1b.
Add support for it. Tested on HP Mini 5102.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
hp_wmi_rfkill_setup cleans up after itself now, so failing completely is
no longer necessary.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
NULLify rfkill pointers during initialization. This prevents dereference
of invalid pointer in case the driver is rebound and some rfkill device
isn't detected anymore. Clear them also in hp_wmi_rfkill_setup failure
path so that an rfkill initialization failure doesn't need to be fatal
for the whole driver.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Split initialization of rfkill devices from hp_wmi_bios_setup() to
hp_wmi_rfkill_setup(). This makes the code somewhat cleaner, especially
with the future command 0x1b rfkill support.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Split buffersize parameter of hp_wmi_perform_query to insize and
outsize. Existing callers are changed to use the same value for insize
and outsize to avoid any regressions, with the exception of
hp_wmi_set_block where the output buffer is unused and therefore outsize
is set to 0 (this change is not seen by BIOS code).
The maximum input buffer size is kept at 4 bytes as per struct
bios_args. Some commands exist that take longer buffers, but they
haven't been implemented. The data portion of bios_args can be trivially
made dynamically allocated later when such larger buffers become needed.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Remove the status variable from hp_wmi_perform_query which holds the
return value from wmi_evaluate_method(). It is never checked as the
function bails out if the output buffer hasn't been allocated which
indicates the call failed.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Check BIOS provided return value code in hp_wmi_perform_query and print
a warning on error. Printing is suppressed for HPWMI_RET_UNKNOWN_CMDTYPE
which is returned when the command type is unsupported.
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Instead of implementing its own version of keymap hanlding switch over
to using sparse keymap library.
Also make sure that we install notify handler only after we allocated
input device and that we remove notify handler before unregistering
input device.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
The machines I have appear to provide their return value in the arguments
structure, not the output structure. Rework the driver to use that again
in order to get rfkill working again.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Add error checking and return -ENOMEM if input_allocate_device() fail.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Thomas Renninger <trenn@suse.de>
Cc: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Thomas Renninger <trenn@suse.de>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Len Brown <len.brown@intel.com>
Cc: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
platform_device_unregister will also call platform_device_put() to drop reference count.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Current implementation in hp_wmi_init does not check any error and always
return success.
This patch properly handles recource reclaim and return err in error path.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
- Improve error handling, by explictly return zero for success, error otherwise
- WMI query command can have arbitrary input sized params
- WMI query command can have specific output sized params (0, 4, 128,..) byte
I like to go on here, but this is a rather intrusive change that should
be looked at first. I am sure the one or other thing can be done better or
there might be typo/bug somewhere.
This did not get any testing yet, only compile tested.
Next steps could be:
- Eventually introduce hp_wmi_perform_{read,write}_query macros
- Introduce new wireless query interface (0x1B)
- more
Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
CC: linux-acpi@vger.kernel.org
CC: platform-driver-x86@vger.kernel.org
Depending on ACPI version (1.0 -> 32 bit) an integer could be
32 or 64 bit long. _WED internal concatenates two integers and
the return value will be 8 byte (2* 32 bit) or 16 byte (2* 64 bit)
long, depending on the ACPI version.
Also the data send with the WMI event is defined to be splitted into:
- Event ID -> 4 bytes
- Event Data -> 4 bytes
This gets messed up with new ACPI versions.
But it's a HP BIOS bug that may get fixed in the future
-> Support both, 16 and 8 byte _WED buffers.
Also the wrong assumption that from the event data sent, only the
first byte is relevant got cleaned up that it fits event_id/event_data
as described above.
Signed-off-by: Thomas Renninger <trenn@suse.de>
CC: robert.moore@intel.com
Signed-off-by: Matthew Garrett <mjg@redhat.com>
CC: platform-driver-x86@vger.kernel.org
CC: linux-acpi@vger.kernel.org
Event id 0x4 defines the hotkey event.
No need (or even wrong) to query HPWMI_HOTKEY_QUERY if event id is != 0x4.
Reorder the eventcode conditionals and use switch case instead of if/else.
Use an enum for the event ids cases.
Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
CC: linux-acpi@vger.kernel.org
CC: platform-driver-x86@vger.kernel.org
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
The HID layer has some scan codes of the form 0xffbc0000 for logitech
devices which do not work if scancode is typed as signed int, so we need
to switch to unsigned it instead. While at it keycode being signed does
not make much sense either.
Acked-by: Márton Németh <nm127@freemail.hu>
Acked-by: Matthew Garrett <mjg@redhat.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
A pointer to hp_wmi_bios_setup is passed to the core via
platform_driver_register and so the function must not disappear when the
.init sections are discarded. Otherwise (if also having HOTPLUG=y)
unbinding and binding a device to the driver via sysfs will result in an
oops as does a device being registered late.
An alternative to this patch is using platform_driver_probe instead of
platform_driver_register plus removing the pointer to the probe function
from the struct platform_driver.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: Frans Pop <elendil@planet.nl>
Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Len Brown <lenb@kernel.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit 3e9b988e4e
"wmi: Free the allocated acpi objects through wmi_get_event_data"
had the same purpose as commit
44ef00e648
"hp-wmi: Fix two memleaks"
This should solve this regression:
http://bugzilla.kernel.org/show_bug.cgi?id=14890
Signed-off-by: Anisse Astier <anisse@astier.eu>
Reported-by: Sedat Dilek <sedat.dilek@googlemail.com>
Signed-off-by: Len Brown <len.brown@intel.com>
When acpi_evaluate_object() is passed ACPI_ALLOCATE_BUFFER,
the caller must kfree the returned buffer if AE_OK is returned.
The callers of wmi_get_event_data() pass ACPI_ALLOCATE_BUFFER,
and thus must check its return value before accessing
or kfree() on the buffer.
Signed-off-by: Len Brown <len.brown@intel.com>
Emphasize that that wmi_install_notify_handler() returns an acpi_status
rather than -errno by by testing ACPI_SUCCESS(), ACPI_FAILURE().
No functional change in this patch, but this confusion caused a bug in dell-wmi.
Signed-off-by: Len Brown <len.brown@intel.com>
These function allocate an acpi object by calling wmi_get_event_data, which
then calls acpi_evaluate_object, and it is not freed afterwards.
And kernel doc is fixed for parameters of wmi_get_event_data.
Signed-off-by: Anisse Astier <anisse@astier.eu>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Acked-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
Signed-off-by: Len Brown <len.brown@intel.com>
1) Add support for reading the hardware blocked state. Previously
we read a combination of the hardware and software blocked states,
reporting it as the software blocked state. This caused some
confusing behaviour.
2) The software state is persistent, mark it as such.
3) Check rfkill in the resume handler. Both the hard and soft
blocked states may change over hibernation.
Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Acked-by: Matthew Garrett <mjg@redhat.com>
Tested-by: Maciej Rutecki <maciej.rutecki@gmail.com>
Signed-off-by: Len Brown <len.brown@intel.com>
rfkill_unregister() should always be followed by rfkill_destroy()
In this case, rfkill_destroy was called two times on wifi_rfkill and
never on bluetooth_rfkill.
Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Acked-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Gets rid of the following warning:
Platform driver 'hp-wmi' needs updating - please use dev_pm_ops
I tested that the resume handler still works on my HP 2510p notebook.
[rjw: Fixed up the definition of hp_wmi_pm_ops.]
Signed-off-by: Frans Pop <elendil@planet.nl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Some systems may not support input events, or registering the input
handler may have failed. So check that an input device exists before
trying to set the docking and tablet mode state during resume.
Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=13865
Reported-and-tested-by: Cédric Godin <cedric@belbone.be>
Signed-off-by: Frans Pop <elendil@planet.nl>
Acked-by: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Fix the third (I think) polarity error I accidentally
introduced in the rfkill rewrite to make wireless work
again on (certain?) HP laptops.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Tested-by: Maciej Rutecki <maciej.rutecki@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
HP tablets send a WMI event when a tablet state change occurs, but use the
same method as is used for reporting docking and undocking. The same query
is used to obtain the state of the hardware. Bit 0 indicates the docking
state, while bit 2 indicates the tablet state. This patch breaks these out
and sends separate input events for tablet and dock state changes. An
additional sysfs file is added to report the tablet state.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Len Brown <len.brown@intel.com>
rfkill_set_global_sw_state() (previously rfkill_set_default()) will no
longer be exported by the rewritten rfkill core.
Instead, platform drivers which can provide persistent soft-rfkill state
across power-down/reboot should indicate their initial state by calling
rfkill_set_sw_state() before registration. Otherwise, they will be
initialized to a default value during registration by a set_block call.
We remove existing calls to rfkill_set_sw_state() which happen before
registration, since these had no effect in the old model. If these
drivers do have persistent state, the calls can be put back (subject
to testing :-). This affects hp-wmi and acer-wmi.
Drivers with persistent state will affect the global state only if
rfkill-input is enabled. This is required, otherwise booting with
wireless soft-blocked and pressing the wireless-toggle key once would
have no apparent effect. This special case will be removed in future
along with rfkill-input, in favour of a more flexible userspace daemon
(see Documentation/feature-removal-schedule.txt).
Now rfkill_global_states[n].def is only used to preserve global states
over EPO, it is renamed to ".sav".
Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This patch completely rewrites the rfkill core to address
the following deficiencies:
* all rfkill drivers need to implement polling where necessary
rather than having one central implementation
* updating the rfkill state cannot be done from arbitrary
contexts, forcing drivers to use schedule_work and requiring
lots of code
* rfkill drivers need to keep track of soft/hard blocked
internally -- the core should do this
* the rfkill API has many unexpected quirks, for example being
asymmetric wrt. alloc/free and register/unregister
* rfkill can call back into a driver from within a function the
driver called -- this is prone to deadlocks and generally
should be avoided
* rfkill-input pointlessly is a separate module
* drivers need to #ifdef rfkill functions (unless they want to
depend on or select RFKILL) -- rfkill should provide inlines
that do nothing if it isn't compiled in
* the rfkill structure is not opaque -- drivers need to initialise
it correctly (lots of sanity checking code required) -- instead
force drivers to pass the right variables to rfkill_alloc()
* the documentation is hard to read because it always assumes the
reader is completely clueless and contains way TOO MANY CAPS
* the rfkill code needlessly uses a lot of locks and atomic
operations in locked sections
* fix LED trigger to actually change the LED when the radio state
changes -- this wasn't done before
Tested-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br> [thinkpad]
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Almost all drivers do not support user_claim, so remove it
completely and always report -EOPNOTSUPP to userspace. Since
userspace cannot really drive rfkill _anyway_ (due to the
odd restrictions imposed by the documentation) having this
code is just pointless.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
It is possible that the system gets docked or undocked while it's
suspended. Generate an input event on resume to notify user space
if there was a state change.
As it is a switch, we can generate the event unconditionally; the
input layer will only pass it on if there is an actual change.
Signed-off-by: Frans Pop <elendil@planet.nl>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Len Brown <len.brown@intel.com>
The error-path code can call rfkill_unregister() with a pointer which does
not contain the result of a call to rfkill_register(). It goes BUG().
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=12560.
Cc: Frans Pop <elendil@planet.nl>
Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Len Brown <lenb@kernel.org>
Acked-by: Matthew Garrett <mjg@redhat.com>
Reported-by: Helge Deller <deller@gmx.de>
Testted-by: Helge Deller <deller@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
If the initial state is not set when the input device is set up, the first
docking event after the module is loaded will be lost.
Signed-off-by: Frans Pop <elendil@planet.nl>
Acked-by: Matthew Garrett <mjg59@srcf.ucam.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Eric Dumazet