From 5620fe641620a790117be5b671c0a48d6dcd3fda Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Thu, 27 Oct 2022 20:02:13 +0200 Subject: ACPICA: Make acpi_ex_load_op() match upstream The acpi_ex_load_op() code has slightly diverged from the upstream implementation, so correct that to make the behavior consistent with the upstream and avoid patch backporting issues going forward. Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/exconfig.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c index d7d74ef87b18..e82faabdf907 100644 --- a/drivers/acpi/acpica/exconfig.c +++ b/drivers/acpi/acpica/exconfig.c @@ -295,8 +295,8 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc, target)); } if (target->common.type != ACPI_TYPE_INTEGER) { - ACPI_EXCEPTION((AE_INFO, AE_TYPE, - "Type not integer: %X\n", target->common.type)); + ACPI_ERROR((AE_INFO, "Type not integer: %X", + target->common.type)); return_ACPI_STATUS(AE_AML_OPERAND_TYPE); } -- cgit v1.2.3 From 5c62d5aab8752e5ee7bfbe75ed6060db1c787f98 Mon Sep 17 00:00:00 2001 From: Huacai Chen Date: Thu, 27 Oct 2022 19:48:53 +0200 Subject: ACPICA: Events: Support fixed PCIe wake event ACPICA commit 32d875705c8ee8f99fd8b78dbed48633486a7640 Some chipsets (such as Loongson's LS7A) support fixed pcie wake event which is defined in the PM1 block(related description can be found in 4.8.4.1.1 PM1 Status Registers, 4.8.4.2.1 PM1 Control Registers and 5.2.9 Fixed ACPI Description Table (FADT)), so we add code to handle it. Link: https://uefi.org/specifications/ACPI/6.4/ Link: https://github.com/acpica/acpica/commit/32d87570 Co-developed-by: Jianmin Lv Signed-off-by: Jianmin Lv Signed-off-by: Huacai Chen Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/evevent.c | 11 +++++++++++ drivers/acpi/acpica/hwsleep.c | 14 ++++++++++++++ drivers/acpi/acpica/utglobal.c | 4 ++++ include/acpi/actypes.h | 3 ++- 4 files changed, 31 insertions(+), 1 deletion(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/evevent.c b/drivers/acpi/acpica/evevent.c index df596d46dd97..82d1728b9bc6 100644 --- a/drivers/acpi/acpica/evevent.c +++ b/drivers/acpi/acpica/evevent.c @@ -142,6 +142,9 @@ static acpi_status acpi_ev_fixed_event_initialize(void) status = acpi_write_bit_register(acpi_gbl_fixed_event_info [i].enable_register_id, + (i == + ACPI_EVENT_PCIE_WAKE) ? + ACPI_ENABLE_EVENT : ACPI_DISABLE_EVENT); if (ACPI_FAILURE(status)) { return (status); @@ -185,6 +188,11 @@ u32 acpi_ev_fixed_event_detect(void) return (int_status); } + if (fixed_enable & ACPI_BITMASK_PCIEXP_WAKE_DISABLE) + fixed_enable &= ~ACPI_BITMASK_PCIEXP_WAKE_DISABLE; + else + fixed_enable |= ACPI_BITMASK_PCIEXP_WAKE_DISABLE; + ACPI_DEBUG_PRINT((ACPI_DB_INTERRUPTS, "Fixed Event Block: Enable %08X Status %08X\n", fixed_enable, fixed_status)); @@ -250,6 +258,9 @@ static u32 acpi_ev_fixed_event_dispatch(u32 event) if (!acpi_gbl_fixed_event_handlers[event].handler) { (void)acpi_write_bit_register(acpi_gbl_fixed_event_info[event]. enable_register_id, + (event == + ACPI_EVENT_PCIE_WAKE) ? + ACPI_ENABLE_EVENT : ACPI_DISABLE_EVENT); ACPI_ERROR((AE_INFO, diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c index bd936476dda9..37b3f641feaa 100644 --- a/drivers/acpi/acpica/hwsleep.c +++ b/drivers/acpi/acpica/hwsleep.c @@ -311,6 +311,20 @@ acpi_status acpi_hw_legacy_wake(u8 sleep_state) [ACPI_EVENT_SLEEP_BUTTON]. status_register_id, ACPI_CLEAR_STATUS); + /* Enable pcie wake event if support */ + if ((acpi_gbl_FADT.flags & ACPI_FADT_PCI_EXPRESS_WAKE)) { + (void) + acpi_write_bit_register(acpi_gbl_fixed_event_info + [ACPI_EVENT_PCIE_WAKE]. + enable_register_id, + ACPI_DISABLE_EVENT); + (void) + acpi_write_bit_register(acpi_gbl_fixed_event_info + [ACPI_EVENT_PCIE_WAKE]. + status_register_id, + ACPI_CLEAR_STATUS); + } + acpi_hw_execute_sleep_method(METHOD_PATHNAME__SST, ACPI_SST_WORKING); return_ACPI_STATUS(status); } diff --git a/drivers/acpi/acpica/utglobal.c b/drivers/acpi/acpica/utglobal.c index cda6e16dddf7..53afa5edb6ec 100644 --- a/drivers/acpi/acpica/utglobal.c +++ b/drivers/acpi/acpica/utglobal.c @@ -186,6 +186,10 @@ struct acpi_fixed_event_info acpi_gbl_fixed_event_info[ACPI_NUM_FIXED_EVENTS] = ACPI_BITREG_RT_CLOCK_ENABLE, ACPI_BITMASK_RT_CLOCK_STATUS, ACPI_BITMASK_RT_CLOCK_ENABLE}, + /* ACPI_EVENT_PCIE_WAKE */ {ACPI_BITREG_PCIEXP_WAKE_STATUS, + ACPI_BITREG_PCIEXP_WAKE_DISABLE, + ACPI_BITMASK_PCIEXP_WAKE_STATUS, + ACPI_BITMASK_PCIEXP_WAKE_DISABLE}, }; #endif /* !ACPI_REDUCED_HARDWARE */ diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h index 3491e454b2ab..ed725335741e 100644 --- a/include/acpi/actypes.h +++ b/include/acpi/actypes.h @@ -723,7 +723,8 @@ typedef u32 acpi_event_type; #define ACPI_EVENT_POWER_BUTTON 2 #define ACPI_EVENT_SLEEP_BUTTON 3 #define ACPI_EVENT_RTC 4 -#define ACPI_EVENT_MAX 4 +#define ACPI_EVENT_PCIE_WAKE 5 +#define ACPI_EVENT_MAX 5 #define ACPI_NUM_FIXED_EVENTS ACPI_EVENT_MAX + 1 /* -- cgit v1.2.3 From 4fe54f509304ea6cc80a40620cac860c57edf7f3 Mon Sep 17 00:00:00 2001 From: Vit Kabele Date: Thu, 27 Oct 2022 19:50:06 +0200 Subject: ACPICA: Check that EBDA pointer is in valid memory ACPICA commit cc9e7763ceb2e2649fe3422130416d84a3c6854a If the memory at 0x40e is uninitialized, the retrieved physical_memory address of EBDA may be beyond the low memory (i.e. above 640K). If so, the kernel may unintentionally access the VGA memory, that might not be decoded or even present in case of virtualization. Link: https://github.com/acpica/acpica/commit/cc9e7763 Signed-off-by: Vit Kabele Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/tbxfroot.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c index 3d09e3f6bd43..ede2745838c8 100644 --- a/drivers/acpi/acpica/tbxfroot.c +++ b/drivers/acpi/acpica/tbxfroot.c @@ -139,7 +139,11 @@ acpi_find_root_pointer(acpi_physical_address *table_address) /* EBDA present? */ - if (physical_address > 0x400) { + /* + * Check that the EBDA pointer from memory is sane and does not point + * above valid low memory + */ + if (physical_address > 0x400 && physical_address < 0xA0000) { /* * 1b) Search EBDA paragraphs (EBDA is required to be a * minimum of 1K length) -- cgit v1.2.3 From 8ff2906513f5ad2f6665b94d1763a26e30bfa47b Mon Sep 17 00:00:00 2001 From: Vit Kabele Date: Thu, 27 Oct 2022 19:50:59 +0200 Subject: ACPICA: Do not touch VGA memory when EBDA < 1ki_b ACPICA commit a36eda9631e84f271319c41288889dd5b1329369 The ACPICA code assumes that EBDA region must be at least 1ki_b in size. Because this is not guaranteed, it might happen that while scanning the memory for RSDP pointer, the kernel touches memory above 640ki_b. This is unwanted as the VGA memory range may not be decoded or even present when running under virtualization. Link: https://github.com/acpica/acpica/commit/a36eda96 Signed-off-by: Vit Kabele Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/tbxfroot.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c index ede2745838c8..f1c2ab0a4561 100644 --- a/drivers/acpi/acpica/tbxfroot.c +++ b/drivers/acpi/acpica/tbxfroot.c @@ -114,6 +114,7 @@ acpi_find_root_pointer(acpi_physical_address *table_address) u8 *table_ptr; u8 *mem_rover; u32 physical_address; + u32 ebda_window_size; ACPI_FUNCTION_TRACE(acpi_find_root_pointer); @@ -145,24 +146,31 @@ acpi_find_root_pointer(acpi_physical_address *table_address) */ if (physical_address > 0x400 && physical_address < 0xA0000) { /* - * 1b) Search EBDA paragraphs (EBDA is required to be a - * minimum of 1K length) + * Calculate the scan window size + * The EBDA is not guaranteed to be larger than a ki_b and in case + * that it is smaller, the scanning function would leave the low + * memory and continue to the VGA range. + */ + ebda_window_size = ACPI_MIN(ACPI_EBDA_WINDOW_SIZE, + 0xA0000 - physical_address); + + /* + * 1b) Search EBDA paragraphs */ table_ptr = acpi_os_map_memory((acpi_physical_address) physical_address, - ACPI_EBDA_WINDOW_SIZE); + ebda_window_size); if (!table_ptr) { ACPI_ERROR((AE_INFO, "Could not map memory at 0x%8.8X for length %u", - physical_address, ACPI_EBDA_WINDOW_SIZE)); + physical_address, ebda_window_size)); return_ACPI_STATUS(AE_NO_MEMORY); } mem_rover = - acpi_tb_scan_memory_for_rsdp(table_ptr, - ACPI_EBDA_WINDOW_SIZE); - acpi_os_unmap_memory(table_ptr, ACPI_EBDA_WINDOW_SIZE); + acpi_tb_scan_memory_for_rsdp(table_ptr, ebda_window_size); + acpi_os_unmap_memory(table_ptr, ebda_window_size); if (mem_rover) { -- cgit v1.2.3 From ee64b827a9af7905cb8b84d882320ecc91640192 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Thu, 27 Oct 2022 19:54:32 +0200 Subject: ACPICA: Add support for FFH Opregion special context data ACPICA commit fad527b6e76babc7527c41325bfbef6bd1a1132b FFH(Fixed Function Hardware) Opregion is approved to be added in ACPI 6.5 via code first approach [1]. It requires special context data similar to GPIO and Generic Serial Bus as it needs to know platform specific offset and length. Add support for the special context data needed by FFH Opregion. FFH op_region enables advanced use of FFH on some architectures. For example, it could be used to easily proxy AML code to architecture-specific behavior (to ensure it is OS initiated) Actual behavior of FFH is ofcourse architecture specific and depends on the FFH bindings. The offset and length could have arch specific meaning or usage. Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3598 # [1] Link: https://github.com/acpica/acpica/commit/fad527b6 Signed-off-by: Sudeep Holla Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/evregion.c | 9 +++++++++ drivers/acpi/acpica/exfield.c | 8 ++++++-- drivers/acpi/acpica/exserial.c | 6 ++++++ include/acpi/acconfig.h | 2 ++ include/acpi/actypes.h | 7 +++++++ 5 files changed, 30 insertions(+), 2 deletions(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c index b96b3a7e78e5..d035092799eb 100644 --- a/drivers/acpi/acpica/evregion.c +++ b/drivers/acpi/acpica/evregion.c @@ -172,6 +172,15 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, ctx->subspace_id = (u8)region_obj->region.address; } + if (region_obj->region.space_id == + ACPI_ADR_SPACE_FIXED_HARDWARE) { + struct acpi_ffh_info *ctx = + handler_desc->address_space.context; + + ctx->length = region_obj->region.length; + ctx->offset = region_obj->region.address; + } + /* * We must exit the interpreter because the region setup will * potentially execute control methods (for example, the _REG method diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c index 2b89a496de65..657f4002f9dc 100644 --- a/drivers/acpi/acpica/exfield.c +++ b/drivers/acpi/acpica/exfield.c @@ -141,7 +141,9 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state, || obj_desc->field.region_obj->region.space_id == ACPI_ADR_SPACE_IPMI || obj_desc->field.region_obj->region.space_id == - ACPI_ADR_SPACE_PLATFORM_RT)) { + ACPI_ADR_SPACE_PLATFORM_RT + || obj_desc->field.region_obj->region.space_id == + ACPI_ADR_SPACE_FIXED_HARDWARE)) { /* SMBus, GSBus, IPMI serial */ @@ -305,7 +307,9 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc, || obj_desc->field.region_obj->region.space_id == ACPI_ADR_SPACE_IPMI || obj_desc->field.region_obj->region.space_id == - ACPI_ADR_SPACE_PLATFORM_RT)) { + ACPI_ADR_SPACE_PLATFORM_RT + || obj_desc->field.region_obj->region.space_id == + ACPI_ADR_SPACE_FIXED_HARDWARE)) { /* SMBus, GSBus, IPMI serial */ diff --git a/drivers/acpi/acpica/exserial.c b/drivers/acpi/acpica/exserial.c index 4da20d7845df..fd63f2042514 100644 --- a/drivers/acpi/acpica/exserial.c +++ b/drivers/acpi/acpica/exserial.c @@ -323,6 +323,12 @@ acpi_ex_write_serial_bus(union acpi_operand_object *source_desc, function = ACPI_WRITE; break; + case ACPI_ADR_SPACE_FIXED_HARDWARE: + + buffer_length = ACPI_FFH_INPUT_BUFFER_SIZE; + function = ACPI_WRITE; + break; + default: return_ACPI_STATUS(AE_AML_INVALID_SPACE_ID); } diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h index c3ae3ea88e17..151e40385673 100644 --- a/include/acpi/acconfig.h +++ b/include/acpi/acconfig.h @@ -190,6 +190,8 @@ #define ACPI_PRM_INPUT_BUFFER_SIZE 26 +#define ACPI_FFH_INPUT_BUFFER_SIZE 256 + /* _sx_d and _sx_w control methods */ #define ACPI_NUM_sx_d_METHODS 4 diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h index ed725335741e..95e4f56f9754 100644 --- a/include/acpi/actypes.h +++ b/include/acpi/actypes.h @@ -1116,6 +1116,13 @@ struct acpi_pcc_info { u8 *internal_buffer; }; +/* Special Context data for FFH Opregion (ACPI 6.5) */ + +struct acpi_ffh_info { + u64 offset; + u64 length; +}; + typedef acpi_status (*acpi_adr_space_setup) (acpi_handle region_handle, u32 function, -- cgit v1.2.3 From 183f0a09d32cf4f007f52718becf1b963549cb54 Mon Sep 17 00:00:00 2001 From: Bob Moore Date: Thu, 27 Oct 2022 19:55:26 +0200 Subject: ACPICA: Improve warning message for "invalid ACPI name" ACPICA commit 91bef8bea9cd69c33447ba1bfe2c4273994500fd Added an underscore instead of an (illegal) * Link: https://github.com/acpica/acpica/commit/91bef8be Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/utstring.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/utstring.c b/drivers/acpi/acpica/utstring.c index c39b5483045d..aae71b8c55d2 100644 --- a/drivers/acpi/acpica/utstring.c +++ b/drivers/acpi/acpica/utstring.c @@ -145,7 +145,7 @@ void acpi_ut_repair_name(char *name) return; } - ACPI_COPY_NAMESEG(&original_name, name); + ACPI_COPY_NAMESEG(&original_name, &name[0]); /* Check each character in the name */ @@ -156,10 +156,10 @@ void acpi_ut_repair_name(char *name) /* * Replace a bad character with something printable, yet technically - * still invalid. This prevents any collisions with existing "good" + * "odd". This prevents any collisions with existing "good" * names in the namespace. */ - name[i] = '*'; + name[i] = '_'; found_bad_char = TRUE; } @@ -169,8 +169,8 @@ void acpi_ut_repair_name(char *name) if (!acpi_gbl_enable_interpreter_slack) { ACPI_WARNING((AE_INFO, - "Invalid character(s) in name (0x%.8X), repaired: [%4.4s]", - original_name, name)); + "Invalid character(s) in name (0x%.8X) %p, repaired: [%4.4s]", + original_name, name, &name[0])); } else { ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Invalid character(s) in name (0x%.8X), repaired: [%4.4s]", -- cgit v1.2.3 From 51aad1a6723b3ed564d243031c4f284298b4329c Mon Sep 17 00:00:00 2001 From: Bob Moore Date: Thu, 27 Oct 2022 19:58:36 +0200 Subject: ACPICA: Finish support for the CDAT table ACPICA commit 8ac4e5116f59d6f9ba2fbeb9ce22ab58237a278f Finish support for the CDAT table, in both the data table compiler and the disassembler. Link: https://github.com/acpica/acpica/commit/8ac4e511 Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/Makefile | 1 + drivers/acpi/acpica/acglobal.h | 1 + drivers/acpi/acpica/actables.h | 5 - drivers/acpi/acpica/acutils.h | 13 +++ drivers/acpi/acpica/tbdata.c | 2 +- drivers/acpi/acpica/tbfadt.c | 2 +- drivers/acpi/acpica/tbprint.c | 77 +------------- drivers/acpi/acpica/tbutils.c | 2 +- drivers/acpi/acpica/tbxfroot.c | 4 +- drivers/acpi/acpica/utcksum.c | 170 +++++++++++++++++++++++++++++++ include/acpi/actbl1.h | 116 ++++++++++++++++++++- include/acpi/actbl2.h | 2 +- tools/power/acpi/tools/acpidump/apdump.c | 4 +- 13 files changed, 311 insertions(+), 88 deletions(-) create mode 100644 drivers/acpi/acpica/utcksum.c (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile index 59700433a96e..9e0d95d76fff 100644 --- a/drivers/acpi/acpica/Makefile +++ b/drivers/acpi/acpica/Makefile @@ -155,6 +155,7 @@ acpi-y += \ utalloc.o \ utascii.o \ utbuffer.o \ + utcksum.o \ utcopy.o \ utexcep.o \ utdebug.o \ diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h index 088d6a7d052c..777457a58340 100644 --- a/drivers/acpi/acpica/acglobal.h +++ b/drivers/acpi/acpica/acglobal.h @@ -24,6 +24,7 @@ ACPI_GLOBAL(struct acpi_table_list, acpi_gbl_root_table_list); ACPI_GLOBAL(struct acpi_table_header *, acpi_gbl_DSDT); ACPI_GLOBAL(struct acpi_table_header, acpi_gbl_original_dsdt_header); +ACPI_INIT_GLOBAL(char *, acpi_gbl_CDAT, NULL); ACPI_INIT_GLOBAL(u32, acpi_gbl_dsdt_index, ACPI_INVALID_TABLE_INDEX); ACPI_INIT_GLOBAL(u32, acpi_gbl_facs_index, ACPI_INVALID_TABLE_INDEX); ACPI_INIT_GLOBAL(u32, acpi_gbl_xfacs_index, ACPI_INVALID_TABLE_INDEX); diff --git a/drivers/acpi/acpica/actables.h b/drivers/acpi/acpica/actables.h index f8d7bfd737df..1c29325e4c7f 100644 --- a/drivers/acpi/acpica/actables.h +++ b/drivers/acpi/acpica/actables.h @@ -124,11 +124,6 @@ void acpi_tb_print_table_header(acpi_physical_address address, struct acpi_table_header *header); -u8 acpi_tb_checksum(u8 *buffer, u32 length); - -acpi_status -acpi_tb_verify_checksum(struct acpi_table_header *table, u32 length); - void acpi_tb_check_dsdt_header(void); struct acpi_table_header *acpi_tb_copy_dsdt(u32 table_index); diff --git a/drivers/acpi/acpica/acutils.h b/drivers/acpi/acpica/acutils.h index 6e6270f96bfb..71175b664f49 100644 --- a/drivers/acpi/acpica/acutils.h +++ b/drivers/acpi/acpica/acutils.h @@ -158,6 +158,19 @@ u8 acpi_ut_valid_name_char(char character, u32 position); void acpi_ut_check_and_repair_ascii(u8 *name, char *repaired_name, u32 count); +/* + * utcksum - Checksum utilities + */ +u8 acpi_ut_generate_checksum(void *table, u32 length, u8 original_checksum); + +u8 acpi_ut_checksum(u8 *buffer, u32 length); + +acpi_status +acpi_ut_verify_cdat_checksum(struct acpi_table_cdat *cdat_table, u32 length); + +acpi_status +acpi_ut_verify_checksum(struct acpi_table_header *table, u32 length); + /* * utnonansi - Non-ANSI C library functions */ diff --git a/drivers/acpi/acpica/tbdata.c b/drivers/acpi/acpica/tbdata.c index a7642b34ce48..1f7677e0dbbe 100644 --- a/drivers/acpi/acpica/tbdata.c +++ b/drivers/acpi/acpica/tbdata.c @@ -522,7 +522,7 @@ acpi_tb_verify_temp_table(struct acpi_table_desc *table_desc, /* Verify the checksum */ status = - acpi_tb_verify_checksum(table_desc->pointer, + acpi_ut_verify_checksum(table_desc->pointer, table_desc->length); if (ACPI_FAILURE(status)) { ACPI_EXCEPTION((AE_INFO, AE_NO_MEMORY, diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c index 31d7ea84a360..f04dc6051320 100644 --- a/drivers/acpi/acpica/tbfadt.c +++ b/drivers/acpi/acpica/tbfadt.c @@ -298,7 +298,7 @@ void acpi_tb_parse_fadt(void) * Validate the FADT checksum before we copy the table. Ignore * checksum error as we want to try to get the DSDT and FACS. */ - (void)acpi_tb_verify_checksum(table, length); + (void)acpi_ut_verify_checksum(table, length); /* Create a local copy of the FADT in common ACPI 2.0+ format */ diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c index 595547db28c0..f07aa9b46f3f 100644 --- a/drivers/acpi/acpica/tbprint.c +++ b/drivers/acpi/acpica/tbprint.c @@ -10,6 +10,7 @@ #include #include "accommon.h" #include "actables.h" +#include "acutils.h" #define _COMPONENT ACPI_TABLES ACPI_MODULE_NAME("tbprint") @@ -39,7 +40,7 @@ static void acpi_tb_fix_string(char *string, acpi_size length) { while (length && *string) { - if (!isprint((int)*string)) { + if (!isprint((int)(u8)*string)) { *string = '?'; } @@ -135,77 +136,3 @@ acpi_tb_print_table_header(acpi_physical_address address, local_header.asl_compiler_revision)); } } - -/******************************************************************************* - * - * FUNCTION: acpi_tb_validate_checksum - * - * PARAMETERS: table - ACPI table to verify - * length - Length of entire table - * - * RETURN: Status - * - * DESCRIPTION: Verifies that the table checksums to zero. Optionally returns - * exception on bad checksum. - * - ******************************************************************************/ - -acpi_status acpi_tb_verify_checksum(struct acpi_table_header *table, u32 length) -{ - u8 checksum; - - /* - * FACS/S3PT: - * They are the odd tables, have no standard ACPI header and no checksum - */ - - if (ACPI_COMPARE_NAMESEG(table->signature, ACPI_SIG_S3PT) || - ACPI_COMPARE_NAMESEG(table->signature, ACPI_SIG_FACS)) { - return (AE_OK); - } - - /* Compute the checksum on the table */ - - checksum = acpi_tb_checksum(ACPI_CAST_PTR(u8, table), length); - - /* Checksum ok? (should be zero) */ - - if (checksum) { - ACPI_BIOS_WARNING((AE_INFO, - "Incorrect checksum in table [%4.4s] - 0x%2.2X, " - "should be 0x%2.2X", - table->signature, table->checksum, - (u8)(table->checksum - checksum))); - -#if (ACPI_CHECKSUM_ABORT) - return (AE_BAD_CHECKSUM); -#endif - } - - return (AE_OK); -} - -/******************************************************************************* - * - * FUNCTION: acpi_tb_checksum - * - * PARAMETERS: buffer - Pointer to memory region to be checked - * length - Length of this memory region - * - * RETURN: Checksum (u8) - * - * DESCRIPTION: Calculates circular checksum of memory region. - * - ******************************************************************************/ - -u8 acpi_tb_checksum(u8 *buffer, u32 length) -{ - u8 sum = 0; - u8 *end = buffer + length; - - while (buffer < end) { - sum = (u8)(sum + *(buffer++)); - } - - return (sum); -} diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c index 633a823be65f..17ad9c227d42 100644 --- a/drivers/acpi/acpica/tbutils.c +++ b/drivers/acpi/acpica/tbutils.c @@ -299,7 +299,7 @@ acpi_tb_parse_root_table(acpi_physical_address rsdp_address) /* Validate the root table checksum */ - status = acpi_tb_verify_checksum(table, length); + status = acpi_ut_verify_checksum(table, length); if (ACPI_FAILURE(status)) { acpi_os_unmap_memory(table, length); return_ACPI_STATUS(status); diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c index f1c2ab0a4561..53afd75bbc06 100644 --- a/drivers/acpi/acpica/tbxfroot.c +++ b/drivers/acpi/acpica/tbxfroot.c @@ -74,14 +74,14 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp) /* Check the standard checksum */ - if (acpi_tb_checksum((u8 *) rsdp, ACPI_RSDP_CHECKSUM_LENGTH) != 0) { + if (acpi_ut_checksum((u8 *)rsdp, ACPI_RSDP_CHECKSUM_LENGTH) != 0) { return (AE_BAD_CHECKSUM); } /* Check extended checksum if table version >= 2 */ if ((rsdp->revision >= 2) && - (acpi_tb_checksum((u8 *) rsdp, ACPI_RSDP_XCHECKSUM_LENGTH) != 0)) { + (acpi_ut_checksum((u8 *)rsdp, ACPI_RSDP_XCHECKSUM_LENGTH) != 0)) { return (AE_BAD_CHECKSUM); } diff --git a/drivers/acpi/acpica/utcksum.c b/drivers/acpi/acpica/utcksum.c new file mode 100644 index 000000000000..c166e4c05ab6 --- /dev/null +++ b/drivers/acpi/acpica/utcksum.c @@ -0,0 +1,170 @@ +// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 +/****************************************************************************** + * + * Module Name: utcksum - Support generating table checksums + * + * Copyright (C) 2000 - 2022, Intel Corp. + * + *****************************************************************************/ + +#include +#include "accommon.h" +#include "acutils.h" + +/* This module used for application-level code only */ + +#define _COMPONENT ACPI_CA_DISASSEMBLER +ACPI_MODULE_NAME("utcksum") + +/******************************************************************************* + * + * FUNCTION: acpi_ut_verify_checksum + * + * PARAMETERS: table - ACPI table to verify + * length - Length of entire table + * + * RETURN: Status + * + * DESCRIPTION: Verifies that the table checksums to zero. Optionally returns + * exception on bad checksum. + * Note: We don't have to check for a CDAT here, since CDAT is + * not in the RSDT/XSDT, and the CDAT table is never installed + * via ACPICA. + * + ******************************************************************************/ +acpi_status acpi_ut_verify_checksum(struct acpi_table_header *table, u32 length) +{ + u8 checksum; + + /* + * FACS/S3PT: + * They are the odd tables, have no standard ACPI header and no checksum + */ + if (ACPI_COMPARE_NAMESEG(table->signature, ACPI_SIG_S3PT) || + ACPI_COMPARE_NAMESEG(table->signature, ACPI_SIG_FACS)) { + return (AE_OK); + } + + /* Compute the checksum on the table */ + + length = table->length; + checksum = + acpi_ut_generate_checksum(ACPI_CAST_PTR(u8, table), length, + table->checksum); + + /* Computed checksum matches table? */ + + if (checksum != table->checksum) { + ACPI_BIOS_WARNING((AE_INFO, + "Incorrect checksum in table [%4.4s] - 0x%2.2X, " + "should be 0x%2.2X", + table->signature, table->checksum, + table->checksum - checksum)); + +#if (ACPI_CHECKSUM_ABORT) + return (AE_BAD_CHECKSUM); +#endif + } + + return (AE_OK); +} + +/******************************************************************************* + * + * FUNCTION: acpi_ut_verify_cdat_checksum + * + * PARAMETERS: table - CDAT ACPI table to verify + * length - Length of entire table + * + * RETURN: Status + * + * DESCRIPTION: Verifies that the CDAT table checksums to zero. Optionally + * returns an exception on bad checksum. + * + ******************************************************************************/ + +acpi_status +acpi_ut_verify_cdat_checksum(struct acpi_table_cdat *cdat_table, u32 length) +{ + u8 checksum; + + /* Compute the checksum on the table */ + + checksum = acpi_ut_generate_checksum(ACPI_CAST_PTR(u8, cdat_table), + cdat_table->length, + cdat_table->checksum); + + /* Computed checksum matches table? */ + + if (checksum != cdat_table->checksum) { + ACPI_BIOS_WARNING((AE_INFO, + "Incorrect checksum in table [%4.4s] - 0x%2.2X, " + "should be 0x%2.2X", + acpi_gbl_CDAT, cdat_table->checksum, + checksum)); + +#if (ACPI_CHECKSUM_ABORT) + return (AE_BAD_CHECKSUM); +#endif + } + + cdat_table->checksum = checksum; + return (AE_OK); +} + +/******************************************************************************* + * + * FUNCTION: acpi_ut_generate_checksum + * + * PARAMETERS: table - Pointer to table to be checksummed + * length - Length of the table + * original_checksum - Value of the checksum field + * + * RETURN: 8 bit checksum of buffer + * + * DESCRIPTION: Computes an 8 bit checksum of the table. + * + ******************************************************************************/ + +u8 acpi_ut_generate_checksum(void *table, u32 length, u8 original_checksum) +{ + u8 checksum; + + /* Sum the entire table as-is */ + + checksum = acpi_ut_checksum((u8 *)table, length); + + /* Subtract off the existing checksum value in the table */ + + checksum = (u8)(checksum - original_checksum); + + /* Compute and return the final checksum */ + + checksum = (u8)(0 - checksum); + return (checksum); +} + +/******************************************************************************* + * + * FUNCTION: acpi_ut_checksum + * + * PARAMETERS: buffer - Pointer to memory region to be checked + * length - Length of this memory region + * + * RETURN: Checksum (u8) + * + * DESCRIPTION: Calculates circular checksum of memory region. + * + ******************************************************************************/ + +u8 acpi_ut_checksum(u8 *buffer, u32 length) +{ + u8 sum = 0; + u8 *end = buffer + length; + + while (buffer < end) { + sum = (u8)(sum + *(buffer++)); + } + + return (sum); +} diff --git a/include/acpi/actbl1.h b/include/acpi/actbl1.h index 2aba6f516e70..4175dce3967c 100644 --- a/include/acpi/actbl1.h +++ b/include/acpi/actbl1.h @@ -45,6 +45,7 @@ #define ACPI_SIG_HMAT "HMAT" /* Heterogeneous Memory Attributes Table */ #define ACPI_SIG_HPET "HPET" /* High Precision Event Timer table */ #define ACPI_SIG_IBFT "IBFT" /* iSCSI Boot Firmware Table */ +#define ACPI_SIG_MSCT "MSCT" /* Maximum System Characteristics Table */ #define ACPI_SIG_S3PT "S3PT" /* S3 Performance (sub)Table */ #define ACPI_SIG_PCCS "PCC" /* PCC Shared Memory Region */ @@ -303,12 +304,125 @@ struct acpi_table_boot { u8 reserved[3]; }; +/******************************************************************************* + * + * CDAT - Coherent Device Attribute Table + * Version 1 + * + * Conforms to the "Coherent Device Attribute Table (CDAT) Specification + " (Revision 1.01, October 2020.) + * + ******************************************************************************/ + +struct acpi_table_cdat { + u32 length; /* Length of table in bytes, including this header */ + u8 revision; /* ACPI Specification minor version number */ + u8 checksum; /* To make sum of entire table == 0 */ + u8 reserved[6]; + u32 sequence; /* Used to detect runtime CDAT table changes */ +}; + +/* CDAT common subtable header */ + +struct acpi_cdat_header { + u8 type; + u8 reserved; + u16 length; +}; + +/* Values for Type field above */ + +enum acpi_cdat_type { + ACPI_CDAT_TYPE_DSMAS = 0, + ACPI_CDAT_TYPE_DSLBIS = 1, + ACPI_CDAT_TYPE_DSMSCIS = 2, + ACPI_CDAT_TYPE_DSIS = 3, + ACPI_CDAT_TYPE_DSEMTS = 4, + ACPI_CDAT_TYPE_SSLBIS = 5, + ACPI_CDAT_TYPE_RESERVED = 6 /* 6 through 0xFF are reserved */ +}; + +/* Subtable 0: Device Scoped Memory Affinity Structure (DSMAS) */ + +struct acpi_cadt_dsmas { + u8 dsmad_handle; + u8 flags; + u16 reserved; + u64 dpa_base_address; + u64 dpa_length; +}; + +/* Flags for subtable above */ + +#define ACPI_CEDT_DSMAS_NON_VOLATILE (1 << 2) + +/* Subtable 1: Device scoped Latency and Bandwidth Information Structure (DSLBIS) */ + +struct acpi_cdat_dslbis { + u8 handle; + u8 flags; /* If Handle matches a DSMAS handle, the definition of this field matches + * Flags field in HMAT System Locality Latency */ + u8 data_type; + u8 reserved; + u64 entry_base_unit; + u16 entry[3]; + u16 reserved2; +}; + +/* Subtable 2: Device Scoped Memory Side Cache Information Structure (DSMSCIS) */ + +struct acpi_cdat_dsmscis { + u8 dsmas_handle; + u8 reserved[3]; + u64 side_cache_size; + u32 cache_attributes; +}; + +/* Subtable 3: Device Scoped Initiator Structure (DSIS) */ + +struct acpi_cdat_dsis { + u8 flags; + u8 handle; + u16 reserved; +}; + +/* Flags for above subtable */ + +#define ACPI_CDAT_DSIS_MEM_ATTACHED (1 << 0) + +/* Subtable 4: Device Scoped EFI Memory Type Structure (DSEMTS) */ + +struct acpi_cdat_dsemts { + u8 dsmas_handle; + u8 memory_type; + u16 reserved; + u64 dpa_offset; + u64 range_length; +}; + +/* Subtable 5: Switch Scoped Latency and Bandwidth Information Structure (SSLBIS) */ + +struct acpi_cdat_sslbis { + u8 data_type; + u8 reserved[3]; + u64 entry_base_unit; +}; + +/* Sub-subtable for above, sslbe_entries field */ + +struct acpi_cdat_sslbe { + u16 portx_id; + u16 porty_id; + u16 latency_or_bandwidth; + u16 reserved; +}; + /******************************************************************************* * * CEDT - CXL Early Discovery Table * Version 1 * - * Conforms to the "CXL Early Discovery Table" (CXL 2.0) + * Conforms to the "CXL Early Discovery Table" (CXL 2.0, October 2020) * ******************************************************************************/ diff --git a/include/acpi/actbl2.h b/include/acpi/actbl2.h index 05116f5c19a8..b2973dbe37ee 100644 --- a/include/acpi/actbl2.h +++ b/include/acpi/actbl2.h @@ -28,6 +28,7 @@ #define ACPI_SIG_APMT "APMT" /* Arm Performance Monitoring Unit table */ #define ACPI_SIG_BDAT "BDAT" /* BIOS Data ACPI Table */ #define ACPI_SIG_CCEL "CCEL" /* CC Event Log Table */ +#define ACPI_SIG_CDAT "CDAT" /* Coherent Device Attribute Table */ #define ACPI_SIG_IORT "IORT" /* IO Remapping Table */ #define ACPI_SIG_IVRS "IVRS" /* I/O Virtualization Reporting Structure */ #define ACPI_SIG_LPIT "LPIT" /* Low Power Idle Table */ @@ -35,7 +36,6 @@ #define ACPI_SIG_MCFG "MCFG" /* PCI Memory Mapped Configuration table */ #define ACPI_SIG_MCHI "MCHI" /* Management Controller Host Interface table */ #define ACPI_SIG_MPST "MPST" /* Memory Power State Table */ -#define ACPI_SIG_MSCT "MSCT" /* Maximum System Characteristics Table */ #define ACPI_SIG_MSDM "MSDM" /* Microsoft Data Management Table */ #define ACPI_SIG_NFIT "NFIT" /* NVDIMM Firmware Interface Table */ #define ACPI_SIG_NHLT "NHLT" /* Non HD Audio Link Table */ diff --git a/tools/power/acpi/tools/acpidump/apdump.c b/tools/power/acpi/tools/acpidump/apdump.c index d54dde02b87d..ea44b0ed5dcb 100644 --- a/tools/power/acpi/tools/acpidump/apdump.c +++ b/tools/power/acpi/tools/acpidump/apdump.c @@ -78,7 +78,9 @@ u8 ap_is_valid_checksum(struct acpi_table_header *table) rsdp = ACPI_CAST_PTR(struct acpi_table_rsdp, table); status = acpi_tb_validate_rsdp(rsdp); } else { - status = acpi_tb_verify_checksum(table, table->length); + /* We don't have to check for a CDAT here, since CDAT is not in the RSDT/XSDT */ + + status = acpi_ut_verify_checksum(table, table->length); } if (ACPI_FAILURE(status)) { -- cgit v1.2.3 From 404ec60438add1afadaffaed34bb5fe4ddcadd40 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Mon, 7 Nov 2022 18:42:36 +0100 Subject: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error. Link: https://lore.kernel.org/linux-acpi/20221019073443.248215-1-chenzhongjin@huawei.com/ # [1] Reported-by: Chen Zhongjin Signed-off-by: Rafael J. Wysocki Reviewed-by: Chen Zhongjin --- drivers/acpi/acpica/dsmethod.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c index ae2e768830bf..9332bc688713 100644 --- a/drivers/acpi/acpica/dsmethod.c +++ b/drivers/acpi/acpica/dsmethod.c @@ -517,7 +517,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, info = ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_evaluate_info)); if (!info) { status = AE_NO_MEMORY; - goto cleanup; + goto pop_walk_state; } info->parameters = &this_walk_state->operands[0]; @@ -529,7 +529,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, ACPI_FREE(info); if (ACPI_FAILURE(status)) { - goto cleanup; + goto pop_walk_state; } next_walk_state->method_nesting_depth = @@ -575,6 +575,12 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, return_ACPI_STATUS(status); +pop_walk_state: + + /* On error, pop the walk state to be deleted from thread */ + + acpi_ds_pop_walk_state(thread); + cleanup: /* On error, we must terminate the method properly */ -- cgit v1.2.3 From 470188b09e92d83c5a997f25f0e8fb8cd2bc3469 Mon Sep 17 00:00:00 2001 From: Li Zetao Date: Thu, 1 Dec 2022 16:05:14 +0800 Subject: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to "acpi_operand_object" used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller. Fixes: 8aa5e56eeb61 ("ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject") Signed-off-by: Li Zetao Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpica/utcopy.c | 7 ------- 1 file changed, 7 deletions(-) (limited to 'drivers/acpi') diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c index 400b9e15a709..63c17f420fb8 100644 --- a/drivers/acpi/acpica/utcopy.c +++ b/drivers/acpi/acpica/utcopy.c @@ -916,13 +916,6 @@ acpi_ut_copy_ipackage_to_ipackage(union acpi_operand_object *source_obj, status = acpi_ut_walk_package_tree(source_obj, dest_obj, acpi_ut_copy_ielement_to_ielement, walk_state); - if (ACPI_FAILURE(status)) { - - /* On failure, delete the destination package object */ - - acpi_ut_remove_reference(dest_obj); - } - return_ACPI_STATUS(status); } -- cgit v1.2.3