summaryrefslogtreecommitdiff
path: root/drivers/acpi/acpica
AgeCommit message (Collapse)Author
2026-07-01ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() aliasRafael J. Wysocki
Commit 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()") added an #ifdef based on a __KERNEL__ check which is sort of nasty to the acpi_ut_safe_strncpy() definition to unbreak ACPICA tools builds broken by commit 97f7d3f9c9ac ("ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()"). However, that #ifdef effectively produces dead code when tools are built because they don't call acpi_ut_safe_strncpy(). Accordingly, drop the existing definition of acpi_ut_safe_strncpy() and define it as a strscpy_pad() alias. Fixes: 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> [ rjw: Tweak the changelog ] Link: https://patch.msgid.link/12941764.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-06-24ACPICA: Unbreak tools build after switching over to strscpy_pad()Rafael J. Wysocki
Commit 97f7d3f9c9ac ("ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()") switched over the ACPICA code in the kernel to using strscpy_pad() instead of a combination of strncpy() and manual NUL-termination of the destination string, but it overlooked the fact that tools also use the code in question and strscpy_pad() is not defined in those builds. Address that by using the original ACPICA code in non-kernel builds. Fixes: 97f7d3f9c9ac ("ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()") Reported-by: Jiri Slaby <jirislaby@kernel.org> Closes: https://lore.kernel.org/all/79e9e913-0fb1-4110-804b-c3b5d0edafe4@kernel Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Kees Cook <kees@kernel.org> [ rjw: Fixed up the number of added code lines ] Link: https://patch.msgid.link/12923581.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-06-11Merge branch 'acpica'Rafael J. Wysocki
Merge ACPICA updates for 7.2-rc1 including the following changes: - Add support for the Legacy Virtual Register (LVR) field in I2C serial bus resource descriptors to ACPICA (Akhil R) - Fix multiple issues related to bounds checks, input validation, use-after-free, and integer overflow checks in the AML interpreter in ACPICA (ikaros) - Update the copyright year to 2026 in ACPICA files and make minor changes related to ACPI 6.6 support (Pawel Chmielewski) - Remove spurious precision from format used to dump parse trees in ACPICA (David Laight) - Add modern standby DSM GUIDs to ACPICA header files (Daniel Schaefer) - Fix FADT 32/64X length mismatch warning in ACPICA (Abdelkader Boudih) - Update D3hot/cold device power states definitions in ACPICA header files (Aymeric Wibo) - Fix NULL pointer dereference in acpi_ns_custom_package() (Weiming Shi) - Update ACPICA version to 20260408 (Saket Dumbre) * acpica: (27 commits) ACPICA: add boundary checks in two places ACPICA: Add package limit checks in parser functions ACPICA: Update version to 20260408 ACPICA: Update the copyright year to 2026 ACPICA: Remove spurious precision from format used to dump parse trees ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() ACPICA: Add validation for node in acpi_ns_build_normalized_path() ACPICA: validate handler object type in two places ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) ACPICA: Prevent adding invalid references ACPICA: add boundary checks in acpi_ps_get_next_field() ACPICA: validate byte_count in acpi_ps_get_next_package_length() ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() ACPICA: fix I2C LVR item count in the conversion table ACPICA: Mention the LVR bits ACPICA: Change LVR to 8 bit value ACPICA: Fetch LVR I2C resource descriptor ...
2026-05-27ACPICA: add boundary checks in two placesikaros
Add boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() to prevent out-of-bounds access. Link: https://github.com/acpica/acpica/commit/cfdc96896d8d Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/5180044.0VBMTVartN@rafael.j.wysocki
2026-05-27ACPICA: Add package limit checks in parser functionsikaros
Add package limit checks in parser functions to prevent out-of-bounds access. Link: https://github.com/acpica/acpica/commit/b31b45af2122 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3212937.CbtlEUcBR6@rafael.j.wysocki
2026-05-27ACPICA: Update the copyright year to 2026Pawel Chmielewski
Update copyright notices in all ACPICA files. Link: https://github.com/acpica/acpica/commit/9def02549a9c Signed-off-by: Pawel Chmielewski <pawel.chmielewski@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/4379132.1IzOArtZ34@rafael.j.wysocki
2026-05-27ACPICA: Remove spurious precision from format used to dump parse treesDavid Laight
The debug code in acpi_ps_delete_parse_tree() uses ("%*.s", level * 4, " ") to indent traces. POSIX requires the empty precision be treated as zero, but the kernel treats is as 'no precision specified'. Change to ("%*s", level * 4, "") since there is additional whitespace and no reason to indent by one space when level is zero. Link: https://github.com/acpica/acpica/commit/a87038098af6 Signed-off-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Pawel Chmielewski <pawel.chmielewski@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2914242.BEx9A2HvPv@rafael.j.wysocki
2026-05-27ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()ikaros
Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() to prevent buffer overflows. Link: https://github.com/acpica/acpica/commit/f85a43098d65 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2230782.OBFZWjSADL@rafael.j.wysocki
2026-05-27ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()Weiming Shi
acpi_ns_custom_package() unconditionally dereferences the first element of the package to read the _BIX version number, without checking for NULL: if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER) When firmware returns a _BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL. acpi_ns_remove_null_elements() does not strip NULL entries for ACPI_PTYPE_CUSTOM packages (fixed-position format would break if elements were shifted), so acpi_ns_custom_package() sees the NULL and causes a crash. Add a NULL check for the first element (version field) before dereferencing it. The caller then receives AE_AML_OPERAND_TYPE instead of crashing. Link: https://github.com/acpica/acpica/commit/f3f111b9013b Reported-by: Xiang Mei <xmei5@asu.edu> Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/5674388.Sb9uPGUboI@rafael.j.wysocki
2026-05-27ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()ikaros
Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent buffer overflows. Link: https://github.com/acpica/acpica/commit/975cb20c7992 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2481429.NG923GbCHz@rafael.j.wysocki
2026-05-27ACPICA: Add validation for node in acpi_ns_build_normalized_path()ikaros
Add validation for node in acpi_ns_build_normalized_path() to prevent use-after-free vulnerabilities. Link: https://github.com/acpica/acpica/commit/b35adf49e89a Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/118666237.nniJfEyVGO@rafael.j.wysocki
2026-05-27ACPICA: validate handler object type in two placesikaros
ACPICA: validate handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). Link: https://github.com/acpica/acpica/commit/f6fc648a1389 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/48111441.fMDQidcC6G@rafael.j.wysocki
2026-05-27ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()ikaros
Improve argument parsing in acpi_ps_get_next_simple_arg() to handle remaining AML data safely. Link: https://github.com/acpica/acpica/commit/ecbb8bcfe301 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2008043.taCxCBeP46@rafael.j.wysocki
2026-05-27ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)ikaros
Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy(). Link: https://github.com/acpica/acpica/commit/d281ec1ac84e Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3760974.R56niFO833@rafael.j.wysocki
2026-05-27ACPICA: Prevent adding invalid referencesikaros
Prevent adding references for local, argument, and debug objects in acpi_ut_copy_simple_object(). Link: https://github.com/acpica/acpica/commit/f576898d7814 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/4511989.ejJDZkT8p0@rafael.j.wysocki
2026-05-27ACPICA: add boundary checks in acpi_ps_get_next_field()ikaros
Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access. Link: https://github.com/acpica/acpica/commit/c39183ea84bc Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/24388159.6Emhk5qWAg@rafael.j.wysocki
2026-05-27ACPICA: validate byte_count in acpi_ps_get_next_package_length()ikaros
Validate package length reading in acpi_ps_get_next_package_length(). Link: https://github.com/acpica/acpica/commit/40e03f9941e2 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3616255.QJadu78ljV@rafael.j.wysocki
2026-05-27ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()ikaros
Fix use-after-free issue in acpi_ds_terminate_control_method() by clearing references to method locals and arguments. Link: https://github.com/acpica/acpica/commit/36f22a94cb1b Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/8730924.NyiUUSuA9g@rafael.j.wysocki
2026-05-27ACPICA: fix I2C LVR item count in the conversion tableAkhil R
For ACPI_RSC_MOVE8, the 'Value' field in struct acpi_rsconvert_info is the item count count and not a bit position like for the bitflags. Set 'Value' as '1' to fix this. Conversion still works coincidentally with '0' because item_count is not reset between table entries, and the previous count value was taking effect. Link: https://github.com/acpica/acpica/commit/70082dc8fc84 Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/6164740.MhkbZ0Pkbq@rafael.j.wysocki
2026-05-27ACPICA: Mention the LVR bitsAkhil R
Add a comment mentioning the LVR byte position in the type_specific_flag. Link: https://github.com/acpica/acpica/commit/014fa9f2dbcc Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/9627007.CDJkKcVGEf@rafael.j.wysocki
2026-05-27ACPICA: Change LVR to 8 bit valueAkhil R
In the LVR I2C resource entry to acpi_rs_convert_i2c_serial_bus[]. Link: https://github.com/acpica/acpica/commit/7650d4a889ea Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3952474.kQq0lBPeGt@rafael.j.wysocki
2026-05-27ACPICA: Fetch LVR I2C resource descriptorAkhil R
Add LVR I2C resource entry to acpi_rs_convert_i2c_serial_bus[]. Link: https://github.com/acpica/acpica/commit/c40411823510 Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/23121545.EfDdHjke4D@rafael.j.wysocki
2026-05-27ACPICA: Fix FADT 32/64X length mismatch warningAbdelkader Boudih
When the 64-bit address is set but bit_width is 0, the spec says the legacy length should be used. That is valid firmware. Skip the warning if bit_width is 0. This avoids false warnings like: 32/64X length mismatch in FADT/gpe0_block: 128/0 Tested on free_BSD 16.0-CURRENT. Link: https://github.com/acpica/acpica/commit/b6387a387c51 Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/8688362.T7Z3S40VBb@rafael.j.wysocki
2026-05-27ACPICA: Add alias node support in namespace handlingikaros
- Mark nodes as alias in ld_namespace2_begin() function. - Skip teardown for alias nodes in acpi_ns_detach_object() function. - Define ANOBJ_IS_ALIAS flag in aclocal.h. Link: https://github.com/acpica/acpica/commit/cfcc46c4f717 Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/14020896.uLZWGnKmhe@rafael.j.wysocki
2026-05-27ACPICA: Fix condition check in acpi_ps_parse_loop()ikaros
Fix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent out-of-bounds access. Link: https://github.com/acpica/acpica/commit/3b537b92336e Signed-off-by: ikaros <void0red@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1959692.tdWV9SEqCh@rafael.j.wysocki
2026-05-25ACPI: button: Enable wakeup GPEs for ACPI buttons at probe timeRafael J. Wysocki
Prior to commit 57c31e6d620f ("ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons"), ACPI button wakeup GPEs having handler methods remained enabled after acpi_wakeup_gpe_init(), but currently they are not enabled because acpi_setup_gpe_for_wake() disables them. That causes function keys to stop working on some systems [1] and there may be other related issues elsewhere. To address that, make the ACPI button driver enable wakeup GPEs for ACPI buttons so long as they have handler methods. While this does not restore the old behavior exactly (the ACPI button driver needs to be bound to the button devices for the GPEs to be enabled), it should be sufficient to restore the missing functionality. For this purpose, introduce acpi_enable_gpe_cond() that enables a GPE if its dispatch type matches the supplied one and modify acpi_button_probe() to use that function for enabling the GPEs in question. Fixes: 57c31e6d620f ("ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons") Reported-by: Nick <nick@kousu.ca> Closes: https://lore.kernel.org/linux-acpi/E2OXET.4X5GTP37VTNC3@kousu.ca/ [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Nick <nick@kousu.ca> Cc: 7.0+ <stable@vger.kernel.org> # 7.0+ Link: https://patch.msgid.link/9629117.CDJkKcVGEf@rafael.j.wysocki
2026-03-23ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()Kees Cook
Replace the deprecated[1] strncpy() with strscpy_pad() in acpi_ut_safe_strncpy(). The function is a "safe strncpy" wrapper that does strncpy(dest, source, dest_size) followed by manual NUL-termination at dest[dest_size - 1]. strscpy_pad() is a direct replacement: it NUL-terminates, zero-pads the remainder, and the manual termination is no longer needed. All callers pass NUL-terminated source strings (C string literals, __FILE__ via ACPI_MODULE_NAME, or user-provided filenames that have already been validated). The destinations are fixed-size char arrays in ACPICA internal structures (allocation->module, aml_op_name, acpi_gbl_db_debug_filename), all consumed as C strings. No behavioral change: strscpy_pad() produces identical output to strncpy() + manual NUL-termination for NUL-terminated sources that are shorter than dest_size. For sources longer than dest_size, strncpy() wrote dest_size non-NUL bytes then the manual termination overwrote the last byte with NUL; strscpy_pad() writes dest_size-1 bytes plus NUL: same result. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://patch.msgid.link/20260323172451.work.079-kees@kernel.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-03-17ACPICA: Update the format of Arg3 of _DSMSaket Dumbre
To get rid of type incompatibility warnings in Linux. Fixes: 81f92cff6d42 ("ACPICA: ACPI_TYPE_ANY does not include the package type") Link: https://github.com/acpica/acpica/commit/4fb74872dcec Signed-off-by: Saket Dumbre <saket.dumbre@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/12856643.O9o76ZdvQC@rafael.j.wysocki
2026-03-02ACPICA: Update the _CPC definition to match ACPI 6.6Saket Dumbre
Update the _CPC definition to also support return package sub-type of a Package (with Integer and Buffer) as per ACPI Spec 6.6. Link: https://github.com/acpica/acpica/commit/17a761944cc2 Signed-off-by: Saket Dumbre <saket.dumbre@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2829238.mvXUDI8C0e@rafael.j.wysocki
2026-01-15ACPICA: ACPI 6.6: Add _VDM (Voltage Domain) objectPawel Chmielewski
A processor voltage domain is an identifier that specifies the voltage plane associated with a given group of processors. Refer to section 6.2.10. _VDM (Voltage Domain) of ACPI 6.6 specification for more information. Link: https://github.com/acpica/acpica/commit/d0dbb157646d Signed-off-by: Pawel Chmielewski <pawel.chmielewski@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1921526.atdPhlSkOF@rafael.j.wysocki
2026-01-15ACPICA: Fix asltests using the Fatal() opcodeArmin Wolf
Some asltests test the behavior of the Fatal() opcode and thus require that said opcode does not return an error when called. Introduce a compile-time option called ACPI_CONTINUE_ON_FATAL to instruct the executor to continue the execution of AML bytecode when encountering a Fatal() opcode. Also update the asltest to use this new option. Fixes: ("Abort AML bytecode execution when executing AML_FATAL_OP") Link: https://github.com/acpica/acpica/commit/428b3410c490 Signed-off-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2052065.usQuhbGJ8B@rafael.j.wysocki
2026-01-15ACPICA: Abort AML bytecode execution when executing AML_FATAL_OPArmin Wolf
The ACPI specification states that when executing AML_FATAL_OP, the OS should log the fatal error event and shutdown in a timely fashion. Windows complies with this requirement by immediatly entering a Bso_d, effectively aborting the execution of the AML bytecode in question. ACPICA however might continue with the AML bytecode execution should acpi_os_signal() simply return AE_OK. This will cause issues because ACPI BIOS implementations might assume that the Fatal() operator does not return. Fix this by aborting the AML bytecode execution in such a case by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a local variable because of its small size (12 bytes) and to ensure that acpi_os_signal() always receives valid information about the fatal ACPI BIOS error. Link: https://github.com/acpica/acpica/commit/d516c7758ba6 Signed-off-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
2026-01-15ACPICA: Add support for the Microsoft display mux _OSI stringArmin Wolf
As per [1]. Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/display/automatic-display-switch [1] Link: https://github.com/acpica/acpica/commit/28b644211ff2 Signed-off-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/10790566.nUPlyArG6x@rafael.j.wysocki
2026-01-15ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()Alexey Simakov
Cover a missed execution path with a new check. Fixes: 0acf24ad7e10 ("ACPICA: Add support for PCC Opregion special context data") Link: https://github.com/acpica/acpica/commit/f421dd9dd897 Signed-off-by: Alexey Simakov <bigalex934@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3030574.e9J7NaK4W3@rafael.j.wysocki
2026-01-15ACPICA: ACPICA: replace ACPI_FREE() with acpi_ut_delete_object_desc()Zilin Guan
acpi_ut_create_internal_object() may allocate memory from a slab cache via kmem_cache_zalloc(), but the code currently frees it with ACPI_FREE(), which calls kfree(). This mismatch prevents the object from being released properly and may lead to memory leaks or other issues. Fix this by replacing ACPI_FREE() with acpi_ut_delete_object_desc(), which matches the allocation method used for internal objects. Link: https://github.com/acpica/acpica/commit/a1c55dfea194 Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/4710853.LvFx2qVVIh@rafael.j.wysocki
2025-11-25ACPICA: Avoid walking the Namespace if start_node is NULLCryolitia PukNgae
Although commit 0c9992315e73 ("ACPICA: Avoid walking the ACPI Namespace if it is not there") fixed the situation when both start_node and acpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed on Honor Magicbook 14 Pro [1]. That happens due to the access to the member of parent_node in acpi_ns_get_next_node(). The NULL pointer dereference will always happen, no matter whether or not the start_node is equal to ACPI_ROOT_OBJECT, so move the check of start_node being NULL out of the if block. Unfortunately, all the attempts to contact Honor have failed, they refused to provide any technical support for Linux. The bad DSDT table's dump could be found on GitHub [2]. DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025 Link: https://github.com/acpica/acpica/commit/1c1b57b9eba4554cb132ee658dd942c0210ed20d Link: https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7 [1] Link: https://github.com/denis-bb/honor-fmb-p-dsdt [2] Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev> Reviewed-by: WangYuli <wangyl5933@chinaunicom.cn> [ rjw: Subject adjustment, changelog edits ] Link: https://patch.msgid.link/20251125-acpica-v1-1-99e63b1b25f8@linux.dev Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-10-21ACPICA: Work around bogus -Wstringop-overread warning since GCC 11Xi Ruoyao
When ACPI_MISALIGNMENT_NOT_SUPPORTED is set, GCC can produce a bogus -Wstringop-overread warning, see [1]. To me, it's very clear that we have a compiler bug here, thus just disable the warning. Fixes: a9d13433fe17 ("LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled") Link: https://lore.kernel.org/all/899f2dec-e8b9-44f4-ab8d-001e160a2aed@roeck-us.net/ Link: https://github.com/acpica/acpica/commit/abf5b573 Link: https://gcc.gnu.org/PR122073 [1] Co-developed-by: Saket Dumbre <saket.dumbre@intel.com> Signed-off-by: Saket Dumbre <saket.dumbre@intel.com> Signed-off-by: Xi Ruoyao <xry111@xry111.site> Acked-by: Huacai Chen <chenhuacai@loongson.cn> Cc: All applicable <stable@vger.kernel.org> [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251021092825.822007-1-xry111@xry111.site Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: ACPI_TYPE_ANY does not include the package typeSaket Dumbre
So add it to the list of acceptable Arg3 types for _DSM. Link: https://github.com/acpica/acpica/commit/6eb81e7c Signed-off-by: Saket Dumbre <saket.dumbre@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Fix largest possible resource descriptor indexDmitry Antipov
ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT). Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be clamped incorrectly and resulting value may issue an out-of-bounds access for 'acpi_gbl_resource_types' array. Compile tested only. Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)") Link: https://github.com/acpica/acpica/commit/cf00116c Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2 Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Print error messages for too few or too many argumentsSaket Dumbre
Fix Issue #1027 by displaying error messages when there are too few or too many arguments in the caller vs the definition of an ASL/AML method. Link: https://github.com/acpica/acpica/commit/cbc243e4 Reported-by: Peter Williams <peter@newton.cx> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
2025-09-15ACPICA: Update dsmethod.c to get rid of unused variable warningSaket Dumbre
All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about the unused variable i after the removal of its usage by PR #1031 addressing Issue #1027 Link: https://github.com/acpica/acpica/commit/6d235320 Signed-off-by: Saket Dumbre <saket.dumbre@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: dispatcher: Use acpi_ds_clear_operands() in ↵Hans de Goede
acpi_ds_call_control_method() When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more. After correcting the for loop to check `i < this_walk_state->num_operands` the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this. Link: https://github.com/acpica/acpica/commit/53fc0220 Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Debugger: drop ACPI_NONSTRING attribute from name_segAhmed Salem
ACPICA commit 4623b3369f3aa1ec5229d461e91c514510a96912 Partially revert commit 70662db73d54 ("ACPICA: Apply ACPI_NONSTRING in more places") as I've yet again incorrectly applied the ACPI_NONSTRING attribute where it is not needed. A warning was initially reported by Collin Funk [1], and further review by Jiri Slaby [2] highlighted another issue related to the same commit. Drop the ACPI_NONSTRING attribute to fix the issue. Fixes: 70662db73d54 ("ACPICA: Apply ACPI_NONSTRING in more places") Link: https://lore.kernel.org/all/87ecvpcypw.fsf@gmail.com [1] Link: https://lore.kernel.org/all/5c210121-c9b8-4458-b1ad-0da24732ac72@kernel.org [2] Link: https://github.com/acpica/acpica/commit/4623b336 Reported-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com> Cc: 6.16+ <stable@vger.kernel.org> # 6.16+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: iASL: Fix printing CDAT table headerAhmed Salem
When disassembling CDAT AML, the lack of CDAT's common ACPI table header should be taken into consideration when printing the table's actual header. As the table header lacks fields like Signature, header information is mangled and incorrect: # $ iasl -d -ds CDAT cdat.aml # Input file cdat.aml, Length 0xE4 (228) bytes # ACPI: ? 0x0000000000000000 000C01 (v00 ? 00180000 ?? 23456789) Both Signature and Length are printed incorrectly, and the remaining fields are not applicable for this special table. To fix this, verify acpi_gbl_CDAT is set (<-ds CDAT> via command line) and Header->Signature is an invalid nameseg (due to the presence of non-ASCII char(s)), then print only the explicitly-passed signature (ACPI_SIG_CDAT) and the table length as cast with a pointer to the struct acpi_table_cdat structure. Link: https://github.com/acpica/acpica/commit/2b5586b4 Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Allow to skip Global Lock initializationHuacai Chen
Introduce acpi_gbl_use_global_lock, which allows to skip the Global Lock initialization. This is useful for systems without Global Lock (such as loong_arch), so as to avoid error messages during boot phase: ACPI Error: Could not enable global_lock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) Link: https://github.com/acpica/acpica/commit/463cb0fe Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Change the compilation conditionsZhe Qiao
To prevent the risk of undefined variables. Link: https://github.com/acpica/acpica/commit/9f86d4c9 Signed-off-by: Zhe Qiao <qiaozhe@iscas.ac.cn> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Remove redundant "#ifdef" definitionsZhe Qiao
Link: https://github.com/acpica/acpica/commit/204776a3 Signed-off-by: Zhe Qiao <qiaozhe@iscas.ac.cn> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-15ACPICA: Modify variable definition positionZhe Qiao
To prevent potential undefined risks. Link: https://github.com/acpica/acpica/commit/efc4d8ab Signed-off-by: Zhe Qiao <qiaozhe@iscas.ac.cn> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-06-26ACPICA: Decrease `AcpiExTracePoint` verbosityMario Limonciello
Early in kernel boot pointers can't be used and so %p shows up incorrectly: ``` extrace-0138 ex_trace_point : Method Begin [0x(____ptrval____):\M460] execution. ``` Later in the boot %p works, but it's not really actually useful when the pathname can resolve properly. Adjust the debug print so that if the Pathname resolves that the pointer isn't also printed: ``` extrace-0138 ex_trace_point : Method Begin [\M460] execution. ``` Link: https://github.com/acpica/acpica/pull/1013 Link: https://github.com/acpica/acpica/commit/bdc2a4e646f097b693aa60f1f2c4228d1e31b0d1 Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20250609032839.525087-1-superm1@kernel.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-06-18ACPICA: Refuse to evaluate a method if arguments are missingRafael J. Wysocki
As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. Closes: https://github.com/acpica/acpica/issues/1027 [1] Reported-by: Peter Williams <peter@newton.cx> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Tested-by: Hans de Goede <hansg@kernel.org> # Dell XPS 9640 with BIOS 1.12.0 Link: https://patch.msgid.link/5909446.DvuYhMxLoT@rjwysocki.net Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-22 11:27:53 +0000