Not all HW supporting WMAX method will support the HDMI mux feature.
Explicitly quirk the HW that does support it.
Signed-off-by: Mario Limonciello <mario_limonciello@dell.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Constify the rfkill_blacklist[] DMI table, the ideapad_rfk_data[] table
and the ideapad_attribute_group attribute group. There's no need to have
them writeable during runtime.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Ike Panhc <ike.pan@canonical.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The actual x401u does not use the so named x401u quirk but the x55u quirk.
All that the x401u quirk does it setting wapf to 4, so rename it to wapf4 to
stop the confusion.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Change the name of the hwmon interface from "compal-laptop" to "compal".
A dash is an invalid character for a hwmon name and caused the call to
hwmon_device_register_with_groups() to fail.
Signed-off-by: Roald Frederickx <roald.frederickx@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The Toshiba Qosmio X75-A series models also come with
the new keymap layout.
This patch adds this model to the alt_keymap_dmi list,
along with an extra key found on these models.
Signed-off-by: Azael Avalos <coproscefalo@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Some Toshiba models (most notably Qosmios) come with an
incomplete backlight method where the AML code doesn't
check for write or read commands and always returns
HCI_SUCCESS and the actual brightness (and in some
cases the max brightness), thus allowing the backlight
interface to be registered without write support.
This patch changes the set_lcd_brightness function,
checking the returned values for values greater than
zero to avoid registering a broken backlight interface.
Signed-off-by: Azael Avalos <coproscefalo@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
If this is going away, it won't be in 2012.
Signed-off-by: Martin Kepplinger <martink@posteo.de>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Yoga models don't offer touchpad ctrl through the ideapad interface, causing
ideapad_sync_touchpad_state to send wrong touchpad enable/disable events.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
These variables don't need to be visible outside of this compilation
unit, make them static.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Mark volume_alsa_control_vol and volume_alsa_control_mute as __initdata,
as snd_ctl_new1() will copy the relevant parts, so there is no need to
keep the master copies around after initialization.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Henrique de Moraes Holschuh <ibm-acpi@hmh.eng.br>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The DMI table is only ever used during initialization. Mark it as
__initconst so its memory can be released afterwards -- roughly 1.5 kB.
In turn, the callback functions can be marked with __init, too.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Jonathan Woithe <jwoithe@just42.net>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
These functions are only called from other initialization routines, so
can be marked __init, too.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Constify the lis3lv02d_device_ids[] ACPI and the lis3lv02d_dmi_ids[] DMI
tables. There's no need to have them writeable during runtime.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Eric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The DMI table is already marked as __initconst, so can be the callback
functions as they're only used in that context.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Robert Gerlach <khnz@gmx.de>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The dell_quirks[] DMI table is only ever used during initialization.
Mark it as __initconst so its memory can be released afterwards --
roughly 5.7 kB. In turn, the callback function can be marked with
__init, too.
Also the touchpad_led_init() function can be marked __init as it's only
referenced from dell_init() -- an __init function.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Constify the asus_quirks[] DMI table. There's no need to have it
writeable during runtime.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Corentin Chary <corentin.chary@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Quite a lot of code and data of acer-wmi.c is only ever used during
initialization. Mark those accordingly -- and constify, where
appropriate -- so the memory can be released afterwards.
All in all those changes move ~10 kB of code and data to the .init
sections, marking them for release after initialization has finished.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: "Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Constify the asus_quirks[] DMI table. There's no need to have it
writeable during runtime.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Corentin Chary <corentin.chary@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The DMI table is only ever used during initialization. Mark it as
__initconst so its memory can be released appropriately. In turn, the
callback function can be marked with __init, too.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Encapsulate acer_suspend() and acer_resume with #ifdef CONFIG_PM_SLEEP
to get rid of the following warnings:
../acer-wmi.c:2046:12: warning: ‘acer_suspend’ defined but not used [-Wunused-function]
../acer-wmi.c:2068:12: warning: ‘acer_resume’ defined but not used [-Wunused-function]
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: "Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
sparse_keymap_setup() will make a copy of the keymap, so we can release
the master copy after initialization.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: "Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The repo on kernel.org is no longer available but has a replacement at
cavan.codon.org.uk.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
This patch removes the null test on block. block is initialized at the
beginning of the function to &wblock->gblock. Since wblock is
dereferenced prior to the null test, wblock must be a valid pointer,
and &wblock->gblock cannot be null.
The following Coccinelle script is used for detecting the change:
@r@
expression e,f;
identifier g,y;
statement S1,S2;
@@
*e = &f->g
<+...
f->y
...+>
*if (e != NULL || ...)
S1 else S2
Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
As reported here: https://bugs.launchpad.net/bugs/1277959
the X550CL needs wapf=4 too.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
BIOS won't light on the wifi-led after S3, so asus-wmi driver needs to
control the wifi and wifi-led status.
But, it'll lead to bt status error if asus-wmi driver controls bt as well.
So, for X200CA, asus-wmi driver controls wifi status only and have to set
wapf to 1.
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Wifi will be controlled by asus-wmi driver when wapf > 0
So, controls the wifi-led when wapf > 0
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
When bl_power support got added to asus-wmi, the error handling for it was
written to ignore -ENODEV, to avoid not registering a backlight interface for
models which have no bl_power control, but do have brightness control.
At the same time the error handling for brightness_max was modified to do the
same, this is wrong, when there is no brightness_max asus-wmi should not
register a backlight interface.
Note the caller of asus_wmi_backlight_init already special cases -ENODEV,
and will not cause the wmi driver regristration to fail because of a
-ENODEV return from asus_wmi_backlight_init.
https://bugzilla.redhat.com/show_bug.cgi?id=1097436
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Some Asus motherboards for desktop PC-s export an acpi-video interface
advertising backlight support. Test the dmi chassis-type and tell acpi-video
to not register a backlight interface on desktops.
https://bugzilla.redhat.com/show_bug.cgi?id=1097436
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
It seems that the same problems which lead to adding an rfkill blacklist and
putting the Lenovo Yoga 2 11 on it are also present on the Lenovo Yoga 2 13
and Lenovo Yoga 2 Pro too:
https://bugzilla.redhat.com/show_bug.cgi?id=1021036https://forums.lenovo.com/t5/Linux-Discussion/Yoga-2-13-not-Pro-Linux-Warning/m-p/1517612
Testing has shown that the firmware rfkill settings are persistent over
reboots. So blacklisting the driver is not good enough, if the wifi is blocked
at the firmware level the wifi needs to be explictly unblocked through the
ideapad-laptop interface.
And at least on the Lenovo Yoga 2 13 the VPCCMD_RF register which on devices
with hardware kill switch reports the hardware switch state, needs to be
explictly set to 1 (radio enabled / not blocked).
So this patch does 3 things to get proper rfkill handling on these models:
1) Instead of blacklisting the rfkill functionality, which means that people
with a firmware blocked wifi get stuck in that situation, ignore the value
reported by the not present hardware rfkill switch, as this is what is causing
ideapad-laptop to wrongly report all radios as hardware blocks. But do register
the rfkill interfaces so that the user can soft [un]block them.
2) On models without a hardware rfkill switch, explictly set VPCCMD_RF to 1
3) Drop the " 11" postfix from the dmi match string, as the entire Yoga 2
series is affected.
Yoga 2 11:
Reported-and-tested-by: Vincent Gerris <vgerris@gmail.com>
Yoga 2 13:
Tested-by: madls05 <http://ubuntuforums.org/showthread.php?t=2215044>
Yoga 2 Pro:
Reported-and-tested-by: Peter F. Patel-Schneider <pfpschneider@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The new keyboard found on the *40 models is also being sold as a standalone
keyboard (with trackpoint):
http://shop.lenovo.com/us/en/itemdetails/0B47189/460/60AC6A0372B14F5BA7B12F1FF88E33C7
This uses a standard HUT code for the F12 key with the 6 square boxes on it,
which gets mapped to KEY_FILE by the kernel. Change the mapping done of
identical laptop key done by thinkpad_acpi to also send KEY_FILE for
consistency.
Cc: Jamie Lentin <jm@lentin.co.uk>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The _set and _get arguments to the EEEPC_CREATE_SENSOR_ATTR() macro
are confusingly named: _set should be _get and vice versa. Rename these
arguments.
Drop the trailing semicolon from that macro, while we're at it.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
When CONFIG_FUJITSU_LAPTOP_DEBUG is disabled and W=1, the
fujitsu-laptop driver builds with the following warnings:
drivers/platform/x86/fujitsu-laptop.c: In function "bl_update_status":
drivers/platform/x86/fujitsu-laptop.c:409:8: warning: suggest braces around empty body in an "if" statement [-Wempty-body]
ret);
^
drivers/platform/x86/fujitsu-laptop.c:418:8: warning: suggest braces around empty body in an "if" statement [-Wempty-body]
ret);
^
Rework the debug printk helper macro to get rid of these. I verified
that this change has no effect on the generated binary, both in the
debug and non-debug case.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Acked-by: Jonathan Woithe <jwoithe@just42.net>
Cc: Matthew Garrett <matthew.garrett@nebula.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
The 'asus-nb-wmi' WAPF parameter must be set to 4, so the internal Wireless LAN device is operational.
Signed-off-by: poma <pomidorabelisima@gmail.com>
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
This is a small set of updates which missed the first pull. It's more msix
updates, some iscsi and qla4xxx fixes, we also have some string null
termination fixes a return value fix and a couple of pm8001 firmware fixes.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQEcBAABAgAGBQJT7mGIAAoJEDeqqVYsXL0MikgIAKAa6LYOyOV8lK+BVBMR0Uhm
tV7ByzA2Ii1CX6I3QMeYziK9Jk9jfkPwia+gytef1gHui/O47m5oa0WJ6SaLJPa/
i5Zc2ZfhIi0tykEQQ6sXYZiIHkIx4yCJr/YPa/SzifyvDEKndtBUbXzpTTIWYMJG
gBjhVXapwNOJWfkWW6WE26DIpqr1Vhn3vU0IRFH9PQ1F8iLaKPwyJIpZSbZNxc9m
Uq3KKthKG2sZESHJpIjBq+fogGmtm0DSmiRPnDo5KsxoYXlrMgqK3JAs1NpIOZy/
Hg8raobuL2lzQFddBKx6PWZZgDb9P5KZvEEWpycNU8+xG1ny5qMe0AZoySs6eG4=
=JzXC
-----END PGP SIGNATURE-----
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull more SCSI changes from James Bottomley:
"This is a small set of updates which missed the first pull. It's more
msix updates, some iscsi and qla4xxx fixes, we also have some string
null termination fixes a return value fix and a couple of pm8001
firmware fixes.
Just a note, we do have a couple of bug fixes coming under separate
cover, but they don't have to be part of the merge window"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
iscsi class: Fix freeing of skb in get host error path
scsi: fix u14-34f printk format warnings
pm8001: fix pm8001_store_update_fw
pm8001: Fix erratic calculation in update_flash
pm8001: Update MAINTAINERS list
libiscsi: return new error code when nop times out
iscsi class: fix get_host_stats return code when not supported
iscsi class: fix get_host_stats error handling
qla4xxx: fix get_host_stats error propagation
qla4xxx: check the return value of dma_alloc_coherent()
scsi: qla4xxx: ql4_mbx.c: Cleaning up missing null-terminate in conjunction with strncpy
scsi: qla4xxx: ql4_os.c: Cleaning up missing null-terminate in conjunction with strncpy
qla4xxx: Use pci_enable_msix_exact() instead of pci_enable_msix()
pm8001: Use pci_enable_msix_exact() instead of pci_enable_msix()
Pull input layer fixes from Dmitry Torokhov:
"Second round of updates for the input subsystem. Mostly small fixups
to the code merged in the first round (atmel_mxt_ts, wacom) but also a
smallish patch to xbox driver to support Xbox One controllers and a
patch to better handle Synaptics profile sensors found in Cr-48
Chromebooks that should not affect any other devices"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: edt-ft5x06 - remove superfluous assignment
Input: xpad - add support for Xbox One controllers
Input: atmel_mxt_ts - fix a few issues reported by Coverity
Input: atmel_mxt_ts - split config update a bit
Input: atmel_mxt_ts - simplify mxt_initialize a bit
Input: joystick - use get_cycles on ARMv8
Input: wacom - fix compiler warning if !CONFIG_PM
Input: cap1106 - allow changing key mapping from userspace
Input: synaptics - use firmware data for Cr-48
Input: synaptics - properly initialize slots for semi-MT
Input: MT - make slot cleanup callable outside mt_sync_frame()
Input: atmel_mxt_ts - mXT224 DMA quirk was fixed in firmware v2.0.AA
Here is the additional fix patches that have been queued up since the
previous pull request. A few HD-audio fixes, a USB-audio quirk
addition, and a couple of trivial cleanup for the legacy OSS codes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABAgAGBQJT7hqWAAoJEGwxgFQ9KSmk5T8P/3aWFguhkpcK9PKCYB+93XAD
04f+fyRXEGHiU6+bvEy3NhC3cRp9++cQteRrzFfFLKoT2zCEKwP3fCJhuls7YWpg
CQUa4ojjqJ0E7dMcCHDxY6efFaDQKwmvu7j4VURegv97O5c7mcosxdMzI+FF5Osf
r/LbOjrpUNMFCFFKdRdU+Y0Msm+BspVt9FqI7Q7ge0GRQprtL21QcnOO2CGQ27lW
UOvRRqUuS5ePAbqlXH0o39awPqEvScK+dWmMKEvamLCbwKp8dPtlClfch4B5qofx
ZdS3nPEyayc10gl49k12qfJop6v2GrVfx/uwW0L6b+yELAmoX4dLBku2Zuw2XL/E
roRA5ZXf4Z0tQVxdYvCTlMlsTDB6WOD9icBoOvSdpnyCT67PGxeTWDzOcTXjZtbv
d+tLC+QpeH3RWzcHPe7PQEe8TOql2uRLwj2MSbzVT45MJdWIY45KoBtzoy15YPIm
RVPgSdNpomQXOFx+MFv4OjljaI2xeMZadf4pSTV52U1Kkaf+AvAKT0hS7p+dFtUo
pb1NLKBSj996Ayub211thziISTwzNQpCWrqLqafHpt7XDkNEjygJPNV9Q0j6fmbd
O+XWw2OiHSbh/SPzRrAoIE0sH2+45+BZcrkwMHD1QMFYyYQ+y1Rpdy0UKPnKKO0c
Oj4W21IY0I19gtq1jBAa
=UPFy
-----END PGP SIGNATURE-----
Merge tag 'sound-fix-3.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Here is the additional fix patches that have been queued up since the
previous pull request. A few HD-audio fixes, a USB-audio quirk
addition, and a couple of trivial cleanup for the legacy OSS codes"
* tag 'sound-fix-3.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda - Set TLV_DB_SCALE_MUTE bit for cx5051 vmaster
ALSA: hda/ca0132 - Don't try loading firmware at resume when already failed
ALSA: hda - Fix pop noises on reboot for Dell XPS 13 9333
ALSA: hda - Set internal mic as default input source on Dell XPS 13 9333
ALSA: usb-audio: fix BOSS ME-25 MIDI regression
ALSA: hda - Fix parsing of CMI8888 codec
ALSA: hda - Fix probing and stuttering on CMI8888 HD-audio controller
ALSA: hda/realtek - Fixed ALC286/ALC288 recording delay for Headset Mic
sound: oss: Remove typedefs wanc_info and wavnc_port_info
sound: oss: uart401: Remove typedef uart401_devc
Pull drm fixes (mostly nouveau) from Dave Airlie:
"One doc buidling fixes for a file that moved, along with a bunch of
nouveau fixes, one a build problem on ARM"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/doc: Refer to proper source file
drm/nouveau/platform: fix compilation error
drm/nouveau/gk20a: add LTC device
drm/nouveau: warn if we fail to re-pin fb on resume
drm/nouveau/nvif: fix dac load detect method definition
drm/gf100-/gr: fix -ENOSPC detection when allocating zbc table entries
drm/nouveau/nvif: return null pointers on failure, in addition to ret != 0
drm/nouveau/ltc: fix tag base address getting truncated if above 4GiB
drm/nvc0-/fb/ram: fix use of non-existant ram if partitions aren't uniform
drm/nouveau/bar: behave better if ioremap failed
drm/nouveau/kms: nouveau_fbcon_accel_fini can be static
drm/nouveau: kill unused variable warning if !__OS_HAS_AGP
drm/nouveau/nvif: fix a number of notify thinkos
Pull EDAC updates from Mauro Carvalho Chehab.
* 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac:
sb_edac: add support for Haswell based systems
sb_edac: Fix mix tab/spaces alignments
edac: add DDR4 and RDDR4
sb_edac: remove bogus assumption on mc ordering
sb_edac: make minimal use of channel_mask
sb_edac: fix socket detection on Ivy Bridge controllers
sb_edac: update Kconfig description
sb_edac: search devices using product id
sb_edac: make RIR limit retrieval per model
sb_edac: make node id retrieval per model
sb_edac: make memory type detection per memory controller
Broadwell (BDW) is similar to Haswell (HSW), the preceding processor generation.
Currently, the only difference in their C-state tables is that PC3 max exit latency
is 33usec on HSW and 40usec on BDW.
Signed-off-by: Len Brown <len.brown@intel.com>
Power efficiency improves on Baytrail (Intel Atom Processor E3000)
when Linux disables C6 auto-demotion.
Based on work by Srinidhi Kasagar <srinidhi.kasagar@intel.com>.
Signed-off-by: Len Brown <len.brown@intel.com>
Cc: x86@kernel.org
The commit
4982223e51 module: set nx before marking module MODULE_STATE_COMING.
introduced a regression: if a module fails to parse its arguments or
if mod_sysfs_setup fails, then the module's memory will be freed
while still read-only. Anything that reuses that memory will crash
as soon as it tries to write to it.
Cc: stable@vger.kernel.org # v3.16
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Truncates and renames are often used to replace old versions of a file
with new versions. Applications often expect this to be an atomic
replacement, even if they haven't done anything to make sure the new
version is fully on disk.
Btrfs has strict flushing in place to make sure that renaming over an
old file with a new file will fully flush out the new file before
allowing the transaction commit with the rename to complete.
This ordering means the commit code needs to be able to lock file pages,
and there are a few paths in the filesystem where we will try to end a
transaction with the page lock held. It's rare, but these things can
deadlock.
This patch removes the ordered flushes and switches to a best effort
filemap_flush like ext4 uses. It's not perfect, but it should fix the
deadlocks.
Signed-off-by: Chris Mason <clm@fb.com>
Under rare circumstances we can end up leaving 2 versions of a checksum
for the same file extent range.
The reason for this is that after calling btrfs_next_leaf we process
slot 0 of the leaf it returns, instead of processing the slot set in
path->slots[0]. Most of the time (by far) path->slots[0] is 0, but after
btrfs_next_leaf() releases the path and before it searches for the next
leaf, another task might cause a split of the next leaf, which migrates
some of its keys to the leaf we were processing before calling
btrfs_next_leaf(). In this case btrfs_next_leaf() returns again the
same leaf but with path->slots[0] having a slot number corresponding
to the first new key it got, that is, a slot number that didn't exist
before calling btrfs_next_leaf(), as the leaf now has more keys than
it had before. So we must really process the returned leaf starting at
path->slots[0] always, as it isn't always 0, and the key at slot 0 can
have an offset much lower than our search offset/bytenr.
For example, consider the following scenario, where we have:
sums->bytenr: 40157184, sums->len: 16384, sums end: 40173568
four 4kb file data blocks with offsets 40157184, 40161280, 40165376, 40169472
Leaf N:
slot = 0 slot = btrfs_header_nritems() - 1
|-------------------------------------------------------------------|
| [(CSUM CSUM 39239680), size 8] ... [(CSUM CSUM 40116224), size 4] |
|-------------------------------------------------------------------|
Leaf N + 1:
slot = 0 slot = btrfs_header_nritems() - 1
|--------------------------------------------------------------------|
| [(CSUM CSUM 40161280), size 32] ... [((CSUM CSUM 40615936), size 8 |
|--------------------------------------------------------------------|
Because we are at the last slot of leaf N, we call btrfs_next_leaf() to
find the next highest key, which releases the current path and then searches
for that next key. However after releasing the path and before finding that
next key, the item at slot 0 of leaf N + 1 gets moved to leaf N, due to a call
to ctree.c:push_leaf_left() (via ctree.c:split_leaf()), and therefore
btrfs_next_leaf() will returns us a path again with leaf N but with the slot
pointing to its new last key (CSUM CSUM 40161280). This new version of leaf N
is then:
slot = 0 slot = btrfs_header_nritems() - 2 slot = btrfs_header_nritems() - 1
|----------------------------------------------------------------------------------------------------|
| [(CSUM CSUM 39239680), size 8] ... [(CSUM CSUM 40116224), size 4] [(CSUM CSUM 40161280), size 32] |
|----------------------------------------------------------------------------------------------------|
And incorrecly using slot 0, makes us set next_offset to 39239680 and we jump
into the "insert:" label, which will set tmp to:
tmp = min((sums->len - total_bytes) >> blocksize_bits,
(next_offset - file_key.offset) >> blocksize_bits) =
min((16384 - 0) >> 12, (39239680 - 40157184) >> 12) =
min(4, (u64)-917504 = 18446744073708634112 >> 12) = 4
and
ins_size = csum_size * tmp = 4 * 4 = 16 bytes.
In other words, we insert a new csum item in the tree with key
(CSUM_OBJECTID CSUM_KEY 40157184 = sums->bytenr) that contains the checksums
for all the data (4 blocks of 4096 bytes each = sums->len). Which is wrong,
because the item with key (CSUM CSUM 40161280) (the one that was moved from
leaf N + 1 to the end of leaf N) contains the old checksums of the last 12288
bytes of our data and won't get those old checksums removed.
So this leaves us 2 different checksums for 3 4kb blocks of data in the tree,
and breaks the logical rule:
Key_N+1.offset >= Key_N.offset + length_of_data_its_checksums_cover
An obvious bad effect of this is that a subsequent csum tree lookup to get
the checksum of any of the blocks with logical offset of 40161280, 40165376
or 40169472 (the last 3 4kb blocks of file data), will get the old checksums.
Cc: stable@vger.kernel.org
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
We've got bug reports that btrfs crashes when quota is enabled on
32bit kernel, typically with the Oops like below:
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f9234590>] find_parent_nodes+0x360/0x1380 [btrfs]
*pde = 00000000
Oops: 0000 [#1] SMP
CPU: 0 PID: 151 Comm: kworker/u8:2 Tainted: G S W 3.15.2-1.gd43d97e-default #1
Workqueue: btrfs-qgroup-rescan normal_work_helper [btrfs]
task: f1478130 ti: f147c000 task.ti: f147c000
EIP: 0060:[<f9234590>] EFLAGS: 00010213 CPU: 0
EIP is at find_parent_nodes+0x360/0x1380 [btrfs]
EAX: f147dda8 EBX: f147ddb0 ECX: 00000011 EDX: 00000000
ESI: 00000000 EDI: f147dda4 EBP: f147ddf8 ESP: f147dd38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 00000004 CR3: 00bf3000 CR4: 00000690
Stack:
00000000 00000000 f147dda4 00000050 00000001 00000000 00000001 00000050
00000001 00000000 d3059000 00000001 00000022 000000a8 00000000 00000000
00000000 000000a1 00000000 00000000 00000001 00000000 00000000 11800000
Call Trace:
[<f923564d>] __btrfs_find_all_roots+0x9d/0xf0 [btrfs]
[<f9237bb1>] btrfs_qgroup_rescan_worker+0x401/0x760 [btrfs]
[<f9206148>] normal_work_helper+0xc8/0x270 [btrfs]
[<c025e38b>] process_one_work+0x11b/0x390
[<c025eea1>] worker_thread+0x101/0x340
[<c026432b>] kthread+0x9b/0xb0
[<c0712a71>] ret_from_kernel_thread+0x21/0x30
[<c0264290>] kthread_create_on_node+0x110/0x110
This indicates a NULL corruption in prefs_delayed list. The further
investigation and bisection pointed that the call of ulist_add_merge()
results in the corruption.
ulist_add_merge() takes u64 as aux and writes a 64bit value into
old_aux. The callers of this function in backref.c, however, pass a
pointer of a pointer to old_aux. That is, the function overwrites
64bit value on 32bit pointer. This caused a NULL in the adjacent
variable, in this case, prefs_delayed.
Here is a quick attempt to band-aid over this: a new function,
ulist_add_merge_ptr() is introduced to pass/store properly a pointer
value instead of u64. There are still ugly void ** cast remaining
in the callers because void ** cannot be taken implicitly. But, it's
safer than explicit cast to u64, anyway.
Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=887046
Cc: <stable@vger.kernel.org> [v3.11+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Chris Mason <clm@fb.com>
When failing to allocate space for the whole compressed extent, we'll
fallback to uncompressed IO, but we've forgotten to redirty the pages
which belong to this compressed extent, and these 'clean' pages will
simply skip 'submit' part and go to endio directly, at last we got data
corruption as we write nothing.
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Tested-By: Martin Steigerwald <martin@lichtvoll.de>
Signed-off-by: Chris Mason <clm@fb.com>
