ACPI support fix for 6.18-rc7

This fixes EINJV2 support introduced during the 6.17 cycle by unbreaking
 the initialization broken by a previous attempted fix, adding sanity
 checks for data coming from the platform firmware, and updating the code
 to handle injecting legacy error types on an EINJV2 capable systems
 properly (Tony Luck).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmkfTbkSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1sW0H/1hrZXwWMnevTKSrjEgcfCu7Bj2JHTNl
 DqkjMOgU4uX+F6cO/Vitfs3j2N4FM6DCQpEvXBFso8jPkUjp0Ekw/zYoePcecdTd
 JPD/IIOcJJBrmbHMkEHwHNiaXEqNxKlvAYvdsVLGPZxut+ysiOqYYRjtYDwSFcjr
 F9FliIDn0HUDBYwV3ItiIZupUjkmficmiLO7AFAZddbugtCSEcdtQw207iq5NSN3
 zfdVyGv0DOVwub3KEcRQOmMr8orUho5Z62/ms4RUl6b8jpIo8S57Yoxp9/J9cfDt
 1eU2q8XnkKy/GbhEGehvRt3D/pTUUGdrgfEM40FUgROR1hI+b5MFE1w=
 =NauX
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "This fixes EINJV2 support introduced during the 6.17 cycle by
  unbreaking the initialization broken by a previous attempted fix,
  adding sanity checks for data coming from the platform firmware, and
  updating the code to handle injecting legacy error types on an EINJV2
  capable systems properly (Tony Luck)"

* tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: APEI: EINJ: Fix EINJV2 initialization and injection
This commit is contained in:
Linus Torvalds 2025-11-20 09:44:27 -08:00
commit 1753d40dce
1 changed files with 41 additions and 23 deletions

View File

@ -182,6 +182,7 @@ bool einj_initialized __ro_after_init;
static void __iomem *einj_param;
static u32 v5param_size;
static u32 v66param_size;
static bool is_v2;
static void einj_exec_ctx_init(struct apei_exec_context *ctx)
@ -283,6 +284,24 @@ static void check_vendor_extension(u64 paddr,
acpi_os_unmap_iomem(p, sizeof(v));
}
static u32 einjv2_init(struct einjv2_extension_struct *e)
{
if (e->revision != 1) {
pr_info("Unknown v2 extension revision %u\n", e->revision);
return 0;
}
if (e->length < sizeof(*e) || e->length > PAGE_SIZE) {
pr_info(FW_BUG "Bad1 v2 extension length %u\n", e->length);
return 0;
}
if ((e->length - sizeof(*e)) % sizeof(e->component_arr[0])) {
pr_info(FW_BUG "Bad2 v2 extension length %u\n", e->length);
return 0;
}
return (e->length - sizeof(*e)) / sizeof(e->component_arr[0]);
}
static void __iomem *einj_get_parameter_address(void)
{
int i;
@ -310,28 +329,21 @@ static void __iomem *einj_get_parameter_address(void)
v5param_size = sizeof(v5param);
p = acpi_os_map_iomem(pa_v5, sizeof(*p));
if (p) {
int offset, len;
memcpy_fromio(&v5param, p, v5param_size);
acpi5 = 1;
check_vendor_extension(pa_v5, &v5param);
if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) {
len = v5param.einjv2_struct.length;
offset = offsetof(struct einjv2_extension_struct, component_arr);
max_nr_components = (len - offset) /
sizeof(v5param.einjv2_struct.component_arr[0]);
/*
* The first call to acpi_os_map_iomem above does not include the
* component array, instead it is used to read and calculate maximum
* number of components supported by the system. Below, the mapping
* is expanded to include the component array.
*/
if (available_error_type & ACPI65_EINJV2_SUPP) {
struct einjv2_extension_struct *e;
e = &v5param.einjv2_struct;
max_nr_components = einjv2_init(e);
/* remap including einjv2_extension_struct */
acpi_os_unmap_iomem(p, v5param_size);
offset = offsetof(struct set_error_type_with_address, einjv2_struct);
v5param_size = offset + struct_size(&v5param.einjv2_struct,
component_arr, max_nr_components);
p = acpi_os_map_iomem(pa_v5, v5param_size);
v66param_size = v5param_size - sizeof(*e) + e->length;
p = acpi_os_map_iomem(pa_v5, v66param_size);
}
return p;
}
}
@ -527,6 +539,7 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
u64 param3, u64 param4)
{
struct apei_exec_context ctx;
u32 param_size = is_v2 ? v66param_size : v5param_size;
u64 val, trigger_paddr, timeout = FIRMWARE_TIMEOUT;
int i, rc;
@ -539,11 +552,11 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
if (acpi5) {
struct set_error_type_with_address *v5param;
v5param = kmalloc(v5param_size, GFP_KERNEL);
v5param = kmalloc(param_size, GFP_KERNEL);
if (!v5param)
return -ENOMEM;
memcpy_fromio(v5param, einj_param, v5param_size);
memcpy_fromio(v5param, einj_param, param_size);
v5param->type = type;
if (type & ACPI5_VENDOR_BIT) {
switch (vendor_flags) {
@ -601,7 +614,7 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
break;
}
}
memcpy_toio(einj_param, v5param, v5param_size);
memcpy_toio(einj_param, v5param, param_size);
kfree(v5param);
} else {
rc = apei_exec_run(&ctx, ACPI_EINJ_SET_ERROR_TYPE);
@ -1132,9 +1145,14 @@ static void einj_remove(struct faux_device *fdev)
struct apei_exec_context ctx;
if (einj_param) {
acpi_size size = (acpi5) ?
v5param_size :
sizeof(struct einj_parameter);
acpi_size size;
if (v66param_size)
size = v66param_size;
else if (acpi5)
size = v5param_size;
else
size = sizeof(struct einj_parameter);
acpi_os_unmap_iomem(einj_param, size);
if (vendor_errors.size)