GPS rfkill support via pre-2009 WMI interface uses hp_wmi_get_sw_state()
and hp_wmi_get_hw_state() to query its current hard and soft block state,
respectively.

In hp_wmi_get_sw_state() a mask is calculated which bit should be checked
in an int value returned by firmware to get current block state: 0x200 <<
(r * 8) which with r being 3 for GPS results in overflow and mask of zero.
The same goes for hp_wmi_get_hw_state().

This effectively means that GPS rfkill on this WMI interface is considered
always both hard and soft blocked.

Unfortunately, later when rfkill subsystem calls hp_wmi_set_block() to sync
this block to hardware firmware at least on my old nc6400 gets confused and
sets both hard and soft blocks on WiFi and BT.

This happens for example on hp-wmi module load.

Since due to overflow described above it is dubious that this ever worked
correctly and HP laptops with modems having GPS support seem to all have
been released well past year 2009 let's just remove GPS rfkill support via
pre-2009 WMI interface.
Signed-off-by: NMaciej S. Szmigiero <mail@maciej.szmigiero.name>
Signed-off-by: NDarren Hart <dvhart@linux.intel.com>

rfkill registration order in hp_wmi_rfkill_setup() is:
1) WiFi,
2) BT,
3) WWAN,
5) GPS.

Unregistration when cleaning up on error return should happen in reverse
order.

This means that: If BT rfkill fails to be allocated we possibly need to
first unregister WiFi rfkill before destroying it.

The same goes with (WWAN, BT) and (GPS, WWAN) pairs.

Also, if WWAN rfkill fails to register we need to (possibly) unregister BT
not the GPS one.  And if GPS rfkill fails to register we need to unregister
WWAN not the BT one.

We never need to unregister GPS rfkill here since if GPS rfkill
registration succeeds this function returns without error so no cleanup is
necessary.
Signed-off-by: NMaciej S. Szmigiero <mail@maciej.szmigiero.name>
Signed-off-by: NDarren Hart <dvhart@linux.intel.com>

Do not write initialize magic on systems that do not have
feature query 0xb. Fixes Bug #82451.

Redefine FEATURE_QUERY to align with 0xb and FEATURE2 with 0xd
for code clearity.

Add a new test function, hp_wmi_bios_2008_later() & simplify
hp_wmi_bios_2009_later(), which fixes a bug in cases where
an improper value is returned. Probably also fixes Bug #69131.

Add missing __init tag.
Signed-off-by: NKyle Evans <kvans32@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDarren Hart <dvhart@linux.intel.com>

Signed-off-by: NStefan Brüns <stefan.bruens@rwth-aachen.de>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

A platform_driver does not need to set an owner, it will be populated by the
driver core.
Signed-off-by: NWolfram Sang <wsa@the-dreams.de>

These functions are only called from other initialization routines, so
can be marked __init, too.
Signed-off-by: NMathias Krause <minipli@googlemail.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

This is a third attempt to enable these buttons. The new variable being
commit 997daa1b (i.e. hp-wmi: detect
"2009 BIOS or later"). Older systems that do not have the 2009 BIOS query
method respond with a dummy value, in this case 4. Using that, we can
target a fairly narrow group of systems. i.e. old enough to not have
HPWMI_FEATURE_QUERY 0xd, but new enough to have HPWMI_BIOS_QUERY 0x9.
This group may be further limited if some systems respond with something
other than 4 to non-existant feature queries.
Signed-off-by: NKyle Evans <kvans32@gmail.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

Some HP BIOS has dummy WMI 0x05 cmd and it causes wireless set cmd to fail.
This patch fixes the problem by detecting "2009 BIOS or later" flag which
determines whether WMI 0x1b is supported and is used to replace WMI 0x05.
Signed-off-by: NAlex Hung <alex.hung@canonical.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

Register order is:
			wifi
			bluetooth
			wwan
			gps

So unregister order must be:
			gps
			wwan
			bluetiith
			wifi

But currently gps and wwan are swapped. Fix that.
Also fix goto links.
Signed-off-by: NKirill Tkhai <tkhai@yandex.ru>
CC: Matthew Garrett <matthew.garrett@nebula.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

This reverts commit b253c9d1. It's still
causing problems on some systems.
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

HP laptops include a POST code error query 0x2A that reports
which point BIOS fails to boot at. The error code is kept in CMOS
until it is cleared.
Signed-off-by: NAlex Hung <alex.hung@canonical.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

Kyle Evans discovered that he needed to set some bits in an EC register in
order to receive hotkey events. Doing so blindly broke some otherwise
working HP laptops. It turns out that there's a WMI call that accesses
the same register, so let's try calling that instead.
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>
Cc: Kyle Evans <kvans32@gmail.com>

HP wmi platform driver fails to initialize GPS and causes poweroff
failure in HP Elitebook 6930p.

Call Trace:
 [<ffffffffa088d25a>] hp_wmi_bios_setup+0x25a/0x3a0 [hp_wmi]
 [<ffffffff8135978c>] platform_drv_probe+0x3c/0x70
 [<ffffffff81356d6a>] ? driver_sysfs_add+0x7a/0xb0
 [<ffffffff81357407>] driver_probe_device+0x87/0x3a0
 [<ffffffff813577f3>] __driver_attach+0x93/0xa0
 [<ffffffff81357760>] ? __device_attach+0x40/0x40
 [<ffffffff81355403>] bus_for_each_dev+0x63/0xa0
 [<ffffffff81356e8e>] driver_attach+0x1e/0x20
 [<ffffffff81356a28>] bus_add_driver+0x1f8/0x2b0
 [<ffffffff81357e81>] driver_register+0x71/0x150
 [<ffffffff813594e6>] platform_driver_register+0x46/0x50
 [<ffffffff813595ab>] platform_driver_probe+0x1b/0xa0
 [<ffffffffa088d55e>] hp_wmi_init+0x1be/0x1fb [hp_wmi]
 [<ffffffffa088d3a0>] ? hp_wmi_bios_setup+0x3a0/0x3a0 [hp_wmi]
 [<ffffffff8100210a>] do_one_initcall+0x10a/0x160
 [<ffffffff810bdac6>] load_module+0x1b46/0x2640
 [<ffffffff8128da20>] ? ddebug_proc_write+0xf0/0xf0
 [<ffffffff810be662>] sys_init_module+0xa2/0xf0
 [<ffffffff814d975d>] system_call_fastpath+0x1a/0x1f
Code: 48 ff ff ff 80 7b 24 00 74 d2 41 83 e5 01 45 38 ec 74 c9 48 8d bb a0 03 00 00 e8 ed fb aa e0 5b 41 5c 41 5d 44 89 f0 41 5e 5d c3 <0f> 0b 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66
RIP  [<ffffffffa05c57af>] rfkill_set_hw_state+0x9f/0xb0 [rfkill]
 RSP <ffff880071523b60>

Check code and find this error is caused by misusing variable bluetooth_rfkill
where gps_rfkill should be.
Reported-and-tested-by: NIru Cai <mytbk920423@gmail.com>
References: https://bugzilla.kernel.org/show_bug.cgi?id=58401
Cc: All <stable@vger.kernel.org>
Signed-off-by: NLan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

New HP laptops start generating new events, and hp-wmi prints unknown
event_ids for them. This patch also removes these messages
Signed-off-by: NAlex Hung <alex.hung@canonical.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

This reverts commit fabf85e3 which breaks
hotkey support on some other HP laptops. We'll try doing this differently
in 3.10.
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

The driver will not quite work if someone unbinds the platform device
from the platform driver via sysfs (moreover it will bomb is the driver
built into the kernel as hp_wmi_bios_remove is marked as __exit and will
not be present in the kernel).

To fix it let's use platform_driver_probe() instead of
platform_driver_register(), which disables binding/unbinding via sysfs.
This also allows us to mark hp_wmi_bios_setup as __init and discard it
once module is initialized.
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

Several models of HP laptops using the same DSDT have hotkey buttons
that do not work until the EC is configured to enable them.
Signed-off-by: NKyle Evans <kvans32@gmail.com>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

Add rfkill support for the GPS radio found in HP laptops (HP Elitebook 2170p and the like)
using the Ericsson F5321/H5321 Mobile Broadband Module.
Signed-off-by: NViliam Trepák <trepo@netcomga.sk>
Signed-off-by: NMatthew Garrett <matthew.garrett@nebula.com>

CONFIG_HOTPLUG is going away as an option.  As a result, the __dev*
markings need to be removed.

This change removes the use of __devinit, __devexit_p, __devinitdata,
__devinitconst, and __devexit from these drivers.

Based on patches originally written by Bill Pemberton, but redone by me
in order to handle some of the coding style issues better, by hand.

Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Joey Lee <jlee@novell.com>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Peter Feuerer <peter@piie.net>
Cc: Corentin Chary <corentin.chary@gmail.com>
Cc: Cezary Jackiewicz <cezary.jackiewicz@gmail.com>
Cc: Robert Gerlach <khnz@gmx.de>
Cc: Ike Panhc <ike.pan@canonical.com>
Cc: Henrique de Moraes Holschuh <ibm-acpi@hmh.eng.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

rfkill_alloc() returns NULL on failure.  Check for it, to make the
static checkers happy.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

[  191.310008] WARNING: kmemcheck: Caught 32-bit read from freed memory (f0d25f14)
[  191.310011] c056d2f088000000105fd2f00000000050415353040000000000000000000000
[  191.310020]  i i i i f f f f f f f f f f f f f f f f f f f f f f f f f f f f
[  191.310027]                                          ^
[  191.310029]
[  191.310032] Pid: 737, comm: modprobe Not tainted 3.0.0-rc5+ #268 Hewlett-Packard HP Compaq 6005 Pro SFF PC/3047h
[  191.310036] EIP: 0060:[<f80b3104>] EFLAGS: 00010286 CPU: 0
[  191.310039] EIP is at hp_wmi_perform_query+0x104/0x150 [hp_wmi]
[  191.310041] EAX: f0d25601 EBX: f0d25f00 ECX: 000121cf EDX: 000121ce
[  191.310043] ESI: f0d25f10 EDI: f0f97ea8 EBP: f0f97ec4 ESP: c173f34c
[  191.310045]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[  191.310046] CR0: 8005003b CR2: f540c000 CR3: 30f30000 CR4: 000006d0
[  191.310048] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[  191.310050] DR6: ffff4ff0 DR7: 00000400
[  191.310051]  [<f80b317b>] hp_wmi_dock_state+0x2b/0x40 [hp_wmi]
[  191.310054]  [<f80b6093>] hp_wmi_init+0x93/0x1a8 [hp_wmi]
[  191.310057]  [<c10011f0>] do_one_initcall+0x30/0x170
[  191.310061]  [<c107ab9f>] sys_init_module+0xef/0x1a60
[  191.310064]  [<c149f998>] sysenter_do_call+0x12/0x28
[  191.310067]  [<ffffffff>] 0xffffffff
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Added pr_fmt and converted printks to pr_<level>.
Removed now unused PREFIX and UNIMPL #defines.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Some recent HP laptops use a new wireless query command type 0x1b.

Add support for it. Tested on HP Mini 5102.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

hp_wmi_rfkill_setup cleans up after itself now, so failing completely is
no longer necessary.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

NULLify rfkill pointers during initialization. This prevents dereference
of invalid pointer in case the driver is rebound and some rfkill device
isn't detected anymore. Clear them also in hp_wmi_rfkill_setup failure
path so that an rfkill initialization failure doesn't need to be fatal
for the whole driver.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Split initialization of rfkill devices from hp_wmi_bios_setup() to
hp_wmi_rfkill_setup(). This makes the code somewhat cleaner, especially
with the future command 0x1b rfkill support.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Split buffersize parameter of hp_wmi_perform_query to insize and
outsize. Existing callers are changed to use the same value for insize
and outsize to avoid any regressions, with the exception of
hp_wmi_set_block where the output buffer is unused and therefore outsize
is set to 0 (this change is not seen by BIOS code).

The maximum input buffer size is kept at 4 bytes as per struct
bios_args. Some commands exist that take longer buffers, but they
haven't been implemented. The data portion of bios_args can be trivially
made dynamically allocated later when such larger buffers become needed.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Remove the status variable from hp_wmi_perform_query which holds the
return value from wmi_evaluate_method(). It is never checked as the
function bails out if the output buffer hasn't been allocated which
indicates the call failed.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Check BIOS provided return value code in hp_wmi_perform_query and print
a warning on error. Printing is suppressed for HPWMI_RET_UNKNOWN_CMDTYPE
which is returned when the command type is unsupported.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Free acpi return memory after query.
Signed-off-by: NZeng Zhaoming <zengzm.kernel@gmail.com>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Instead of implementing its own version of keymap hanlding switch over
to using sparse keymap library.

Also make sure that we install notify handler only after we allocated
input device and that we remove notify handler before unregistering
input device.
Signed-off-by: NDmitry Torokhov <dtor@mail.ru>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

The machines I have appear to provide their return value in the arguments
structure, not the output structure. Rework the driver to use that again
in order to get rfkill working again.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Signed-off-by: NThomas Renninger <trenn@suse.de>
CC: linux-acpi@vger.kernel.or
CC: platform-driver-x86@vger.kernel.org
CC: mjg@redhat.com
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

This should have been an "and". Additionally checking for !obj
is even better.
Signed-off-by: NThomas Renninger <trenn@suse.de>
CC: linux-acpi@vger.kernel.or
CC: platform-driver-x86@vger.kernel.org
CC: mjg@redhat.com
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Add error checking and return -ENOMEM if input_allocate_device() fail.
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Acked-by: NThomas Renninger <trenn@suse.de>
Cc: Matthew Garrett <mjg@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Signed-off-by: NThomas Renninger <trenn@suse.de>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Len Brown <len.brown@intel.com>
Cc: Axel Lin <axel.lin@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

platform_device_unregister will also call platform_device_put() to drop reference count.
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

Current implementation in hp_wmi_init does not check any error and always
return success.
This patch properly handles recource reclaim and return err in error path.
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>

- Improve error handling, by explictly return zero for success, error otherwise
- WMI query command can have arbitrary input sized params
- WMI query command can have specific output sized params (0, 4, 128,..) byte

I like to go on here, but this is a rather intrusive change that should
be looked at first. I am sure the one or other thing can be done better or
there might be typo/bug somewhere.

This did not get any testing yet, only compile tested.

Next steps could be:
  - Eventually introduce hp_wmi_perform_{read,write}_query macros
  - Introduce new wireless query interface (0x1B)
  - more
Signed-off-by: NThomas Renninger <trenn@suse.de>
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
CC: linux-acpi@vger.kernel.org
CC: platform-driver-x86@vger.kernel.org

Depending on ACPI version (1.0 -> 32 bit) an integer could be
32 or 64 bit long. _WED internal concatenates two integers and
the return value will be 8 byte (2* 32 bit) or 16 byte (2* 64 bit)
long, depending on the ACPI version.

Also the data send with the WMI event is defined to be splitted into:
  - Event ID -> 4 bytes
  - Event Data -> 4 bytes

This gets messed up with new ACPI versions.
But it's a HP BIOS bug that may get fixed in the future
-> Support both, 16 and 8 byte _WED buffers.

Also the wrong assumption that from the event data sent, only the
first byte is relevant got cleaned up that it fits event_id/event_data
as described above.
Signed-off-by: NThomas Renninger <trenn@suse.de>
CC: robert.moore@intel.com
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
CC: platform-driver-x86@vger.kernel.org
CC: linux-acpi@vger.kernel.org