From 73d15a7c13bfe1292db85ed3de8dfa711291819d Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Tue, 13 Dec 2022 13:34:54 +0100 Subject: [PATCH 1/8] ACPI: PMIC: Add pmic_i2c_address to BYT Crystal Cove support Add a pmic_i2c_address entry to intel_pmic_bytcrc.c, so that intel_soc_pmic_exec_mipi_pmic_seq_element() can be used on devices with a Bay Trail Crystal Cove PMIC OpRegion driver. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki --- drivers/acpi/pmic/intel_pmic_bytcrc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/pmic/intel_pmic_bytcrc.c b/drivers/acpi/pmic/intel_pmic_bytcrc.c index 9ea79f2109658..2b09f8da5400e 100644 --- a/drivers/acpi/pmic/intel_pmic_bytcrc.c +++ b/drivers/acpi/pmic/intel_pmic_bytcrc.c @@ -283,6 +283,7 @@ static const struct intel_pmic_opregion_data intel_crc_pmic_opregion_data = { .power_table_count= ARRAY_SIZE(power_table), .thermal_table = thermal_table, .thermal_table_count = ARRAY_SIZE(thermal_table), + .pmic_i2c_address = 0x6e, }; static int intel_crc_pmic_opregion_probe(struct platform_device *pdev) From f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc Mon Sep 17 00:00:00 2001 From: Armin Wolf Date: Sat, 14 Jan 2023 09:50:50 +0100 Subject: [PATCH 2/8] ACPI: battery: Fix missing NUL-termination with large strings When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later. This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse). Fix this by using strscpy() which ensures that the result is always NUL-terminated. Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") Signed-off-by: Armin Wolf Signed-off-by: Rafael J. Wysocki --- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index f4badcdde76e6..fb64bd217d826 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery, if (element->type == ACPI_TYPE_STRING || element->type == ACPI_TYPE_BUFFER) - strncpy(ptr, element->string.pointer, 32); + strscpy(ptr, element->string.pointer, 32); else if (element->type == ACPI_TYPE_INTEGER) { strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64)); From 53fc7e80f3aa9c34d396bcfbcc03a4c0d2eaac96 Mon Sep 17 00:00:00 2001 From: Shuai Xue Date: Wed, 18 Jan 2023 14:35:04 +0800 Subject: [PATCH 3/8] ACPI: APEI: EINJ: Limit error type to 32-bit width The bit map of error types to inject is 32-bit width [1]. Add parameter check to reflect the fact. [1] ACPI Specification 6.4, Section 18.6.4. Error Types Signed-off-by: Shuai Xue Reviewed-by: Tony Luck Signed-off-by: Rafael J. Wysocki --- drivers/acpi/apei/einj.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c index ab86b2f4e719f..b4373e5756605 100644 --- a/drivers/acpi/apei/einj.c +++ b/drivers/acpi/apei/einj.c @@ -616,6 +616,10 @@ static int error_type_set(void *data, u64 val) u32 available_error_type = 0; u32 tval, vendor; + /* Only low 32 bits for error type are valid */ + if (val & GENMASK_ULL(63, 32)) + return -EINVAL; + /* * Vendor defined types have 0x80000000 bit set, and * are not enumerated by ACPI_EINJ_GET_ERROR_TYPE From a1a32ded2887fd421d67e9c9b67ae4504bdb08c9 Mon Sep 17 00:00:00 2001 From: Armin Wolf Date: Thu, 19 Jan 2023 15:21:14 +0100 Subject: [PATCH 4/8] ACPI: battery: Fix buffer overread if not NUL-terminated If a buffer containing ASCII characters is not NUL-terminated (which is perfectly legal according to the ACPI specification), the ACPI battery driver might not honor its length. Fix this by limiting the amount of data to be copied to the buffer length while also using strscpy() to make sure that the resulting string is always NUL-terminated. Also replace strncpy() vs strscpy(). Signed-off-by: Armin Wolf Signed-off-by: Rafael J. Wysocki --- drivers/acpi/battery.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index fb64bd217d826..0ec12a7dbccad 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -437,16 +437,25 @@ static int extract_package(struct acpi_battery *battery, element = &package->package.elements[i]; if (offsets[i].mode) { u8 *ptr = (u8 *)battery + offsets[i].offset; + u32 len = 32; - if (element->type == ACPI_TYPE_STRING || - element->type == ACPI_TYPE_BUFFER) - strscpy(ptr, element->string.pointer, 32); - else if (element->type == ACPI_TYPE_INTEGER) { - strncpy(ptr, (u8 *)&element->integer.value, - sizeof(u64)); - ptr[sizeof(u64)] = 0; - } else + switch (element->type) { + case ACPI_TYPE_BUFFER: + if (len > element->buffer.length + 1) + len = element->buffer.length + 1; + + fallthrough; + case ACPI_TYPE_STRING: + strscpy(ptr, element->string.pointer, len); + + break; + case ACPI_TYPE_INTEGER: + strscpy(ptr, (u8 *)&element->integer.value, sizeof(u64) + 1); + + break; + default: *ptr = 0; /* don't have value */ + } } else { int *x = (int *)((u8 *)battery + offsets[i].offset); *x = (element->type == ACPI_TYPE_INTEGER) ? From 91507d25a67c561f97c34fdd9fdf04e9a1dd7355 Mon Sep 17 00:00:00 2001 From: Armin Wolf Date: Thu, 19 Jan 2023 15:21:15 +0100 Subject: [PATCH 5/8] ACPI: battery: Increase maximum string length On the Dell Inspiron 3505, the battery model name is represented as a hex string containing seven numbers, causing it to be larger than the current maximum string length (32). Increase this length to 64 to avoid truncating the string in such cases. Also introduce a common define for the length. Signed-off-by: Armin Wolf Signed-off-by: Rafael J. Wysocki --- drivers/acpi/battery.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index 0ec12a7dbccad..9c67ed02d7973 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -42,6 +42,8 @@ #define ACPI_BATTERY_STATE_CHARGING 0x2 #define ACPI_BATTERY_STATE_CRITICAL 0x4 +#define MAX_STRING_LENGTH 64 + MODULE_AUTHOR("Paul Diefenbaugh"); MODULE_AUTHOR("Alexey Starikovskiy "); MODULE_DESCRIPTION("ACPI Battery Driver"); @@ -118,10 +120,10 @@ struct acpi_battery { int capacity_granularity_1; int capacity_granularity_2; int alarm; - char model_number[32]; - char serial_number[32]; - char type[32]; - char oem_info[32]; + char model_number[MAX_STRING_LENGTH]; + char serial_number[MAX_STRING_LENGTH]; + char type[MAX_STRING_LENGTH]; + char oem_info[MAX_STRING_LENGTH]; int state; int power_unit; unsigned long flags; @@ -437,7 +439,7 @@ static int extract_package(struct acpi_battery *battery, element = &package->package.elements[i]; if (offsets[i].mode) { u8 *ptr = (u8 *)battery + offsets[i].offset; - u32 len = 32; + u32 len = MAX_STRING_LENGTH; switch (element->type) { case ACPI_TYPE_BUFFER: From 7de6c3fb6dfbf9b920caa8cad953d8ac406f6790 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 25 Jan 2023 12:38:11 +0100 Subject: [PATCH 6/8] ACPI: PMIC: Add comments with DSDT power opregion field names The DSDTs of CHT devices using the Dollar Cove TI PMIC, all use LDO1 - LDO14 names for the DSDT power opregion field names. Add comments with these fields to make it easier to see which PMIC registers are being set by ACPI code using these. Note that LDO4 is missing and the mapped registers jump from 0x43 to 0x45 to match. This matches with how the fields are declared in the DSDT where LDO4 is skipped too. Note there is no hole in the field addresses, LDO4 is simply just not defined on either side. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki --- drivers/acpi/pmic/intel_pmic_chtdc_ti.c | 26 ++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/drivers/acpi/pmic/intel_pmic_chtdc_ti.c b/drivers/acpi/pmic/intel_pmic_chtdc_ti.c index 418eec5230250..c84ef3d151819 100644 --- a/drivers/acpi/pmic/intel_pmic_chtdc_ti.c +++ b/drivers/acpi/pmic/intel_pmic_chtdc_ti.c @@ -20,19 +20,19 @@ #define CHTDC_TI_GPADC 0x5a static struct pmic_table chtdc_ti_power_table[] = { - { .address = 0x00, .reg = 0x41 }, - { .address = 0x04, .reg = 0x42 }, - { .address = 0x08, .reg = 0x43 }, - { .address = 0x0c, .reg = 0x45 }, - { .address = 0x10, .reg = 0x46 }, - { .address = 0x14, .reg = 0x47 }, - { .address = 0x18, .reg = 0x48 }, - { .address = 0x1c, .reg = 0x49 }, - { .address = 0x20, .reg = 0x4a }, - { .address = 0x24, .reg = 0x4b }, - { .address = 0x28, .reg = 0x4c }, - { .address = 0x2c, .reg = 0x4d }, - { .address = 0x30, .reg = 0x4e }, + { .address = 0x00, .reg = 0x41 }, /* LDO1 */ + { .address = 0x04, .reg = 0x42 }, /* LDO2 */ + { .address = 0x08, .reg = 0x43 }, /* LDO3 */ + { .address = 0x0c, .reg = 0x45 }, /* LDO5 */ + { .address = 0x10, .reg = 0x46 }, /* LDO6 */ + { .address = 0x14, .reg = 0x47 }, /* LDO7 */ + { .address = 0x18, .reg = 0x48 }, /* LDO8 */ + { .address = 0x1c, .reg = 0x49 }, /* LDO9 */ + { .address = 0x20, .reg = 0x4a }, /* LD10 */ + { .address = 0x24, .reg = 0x4b }, /* LD11 */ + { .address = 0x28, .reg = 0x4c }, /* LD12 */ + { .address = 0x2c, .reg = 0x4d }, /* LD13 */ + { .address = 0x30, .reg = 0x4e }, /* LD14 */ }; static struct pmic_table chtdc_ti_thermal_table[] = { From cb18703c179713056bd7e3bdfc2260ab4e8658f0 Mon Sep 17 00:00:00 2001 From: Adam Niederer Date: Sat, 11 Feb 2023 15:13:33 -0500 Subject: [PATCH 7/8] ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which causes the built-in keyboard to not work. This restores the functionality by adding an IRQ override. No other IRQs were being overridden before, so this should be all that is needed for these systems. I have personally tested this on the 15" model (MG-VCP2-15A3070T), and I have confirmation that the issue is present on the 17" model (MG-VCP2-17A3070T). Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Signed-off-by: Adam Niederer Signed-off-by: Rafael J. Wysocki --- drivers/acpi/resource.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c index 192d1784e409b..1d9d3364bc2b5 100644 --- a/drivers/acpi/resource.c +++ b/drivers/acpi/resource.c @@ -478,6 +478,24 @@ static const struct dmi_system_id schenker_gm_rg[] = { { } }; +static const struct dmi_system_id maingear_laptop[] = { + { + .ident = "MAINGEAR Vector Pro 2 15", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), + DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-15A3070T"), + } + }, + { + .ident = "MAINGEAR Vector Pro 2 17", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), + DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-17A3070T"), + }, + }, + { } +}; + struct irq_override_cmp { const struct dmi_system_id *system; unsigned char irq; @@ -493,6 +511,7 @@ static const struct irq_override_cmp override_table[] = { { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, }; static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity, From 17bb7046e7ce038a73ee97eaa804e0300c5199e2 Mon Sep 17 00:00:00 2001 From: Werner Sembach Date: Mon, 13 Feb 2023 19:16:53 +0100 Subject: [PATCH 8/8] ACPI: resource: Do IRQ override on all TongFang GMxRGxx Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15") override for all vendors using this mainboard. Signed-off-by: Werner Sembach Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Signed-off-by: Rafael J. Wysocki --- drivers/acpi/resource.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c index 1d9d3364bc2b5..a222bda7e15b0 100644 --- a/drivers/acpi/resource.c +++ b/drivers/acpi/resource.c @@ -467,11 +467,10 @@ static const struct dmi_system_id lenovo_laptop[] = { { } }; -static const struct dmi_system_id schenker_gm_rg[] = { +static const struct dmi_system_id tongfang_gm_rg[] = { { - .ident = "XMG CORE 15 (M22)", + .ident = "TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD", .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), }, }, @@ -510,7 +509,7 @@ static const struct irq_override_cmp override_table[] = { { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, - { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, };