CVS commit: [netbsd-9] src/sys/dev/acpi
Module Name:src
Committed By: martin
Date: Tue Jun 30 18:45:18 UTC 2020
Modified Files:
src/sys/dev/acpi [netbsd-9]: acpi_display.c
Log Message:
Pull up following revision(s) (requested by sborrill in ticket #978):
sys/dev/acpi/acpi_display.c: revision 1.18
Only need to set brightness if reading the initial state fails
to sync firmware and the driver. Avoids black screen at boot time.
Thanks to jmcneill@
To generate a diff of this commit:
cvs rdiff -u -r1.16.16.1 -r1.16.16.2 src/sys/dev/acpi/acpi_display.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/acpi/acpi_display.c
diff -u src/sys/dev/acpi/acpi_display.c:1.16.16.1 src/sys/dev/acpi/acpi_display.c:1.16.16.2
--- src/sys/dev/acpi/acpi_display.c:1.16.16.1 Wed Apr 29 13:36:57 2020
+++ src/sys/dev/acpi/acpi_display.c Tue Jun 30 18:45:18 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_display.c,v 1.16.16.1 2020/04/29 13:36:57 martin Exp $ */
+/* $NetBSD: acpi_display.c,v 1.16.16.2 2020/06/30 18:45:18 martin Exp $ */
/*-
* Copyright (c) 2010 The NetBSD Foundation, Inc.
@@ -66,7 +66,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: acpi_display.c,v 1.16.16.1 2020/04/29 13:36:57 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_display.c,v 1.16.16.2 2020/06/30 18:45:18 martin Exp $");
#include
#include
@@ -647,8 +647,8 @@ acpidisp_out_attach(device_t parent, dev
* Synchronize ACPI and driver brightness levels, and
* check that brightness control is working.
*/
- (void)acpidisp_get_brightness(osc, >bc_current);
- if (acpidisp_set_brightness(osc, bc->bc_current)) {
+ if (acpidisp_get_brightness(osc, >bc_current) &&
+ acpidisp_set_brightness(osc, bc->bc_current)) {
kmem_free(bc->bc_level,
bc->bc_level_count * sizeof(*bc->bc_level));
kmem_free(bc, sizeof(*bc));
CVS commit: [netbsd-9] src/sys/dev/acpi
Module Name:src
Committed By: martin
Date: Sat Jun 20 15:52:50 UTC 2020
Modified Files:
src/sys/dev/acpi [netbsd-9]: acpi_ec.c
Log Message:
Pull up following revision(s) (requested by jdolecek in ticket #959):
sys/dev/acpi/acpi_ec.c: revision 1.84
only install space handler and enable interrupt for EC if ACPI
claims the device is actually present, it's not enough when there
is entry for it in the ACPI tables
fixes interrupt storm triggered on Dell PowerEdge R220 by enabling
GPE interrupt on a non-enabled EC (for which _REG call later
fails), reported and fix tested by Dima Veselov:
http://mail-index.netbsd.org/netbsd-users/2020/03/02/msg024166.html
XXX pullup netbsd-9
To generate a diff of this commit:
cvs rdiff -u -r1.75.20.3 -r1.75.20.4 src/sys/dev/acpi/acpi_ec.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/acpi/acpi_ec.c
diff -u src/sys/dev/acpi/acpi_ec.c:1.75.20.3 src/sys/dev/acpi/acpi_ec.c:1.75.20.4
--- src/sys/dev/acpi/acpi_ec.c:1.75.20.3 Wed Apr 29 13:33:35 2020
+++ src/sys/dev/acpi/acpi_ec.c Sat Jun 20 15:52:50 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_ec.c,v 1.75.20.3 2020/04/29 13:33:35 martin Exp $ */
+/* $NetBSD: acpi_ec.c,v 1.75.20.4 2020/06/20 15:52:50 martin Exp $ */
/*-
* Copyright (c) 2007 Joerg Sonnenberger .
@@ -59,7 +59,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.75.20.3 2020/04/29 13:33:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.75.20.4 2020/06/20 15:52:50 martin Exp $");
#include
#include
@@ -268,6 +268,11 @@ acpiec_attach(device_t parent, device_t
goto fail0;
}
+ if (!acpi_device_present(aa->aa_node->ad_handle)) {
+ aprint_normal(": not present\n");
+ goto fail0;
+ }
+
if (!acpiec_parse_gpe_package(self, aa->aa_node->ad_handle,
_handle, ))
goto fail0;
CVS commit: [netbsd-9] src/sys/dev/acpi
Module Name:src Committed By: martin Date: Wed Apr 29 13:36:57 UTC 2020 Modified Files: src/sys/dev/acpi [netbsd-9]: acpi_display.c Log Message: Pull up following revision(s) (requested by jmcneill in ticket #867): sys/dev/acpi/acpi_display.c: revision 1.17 Demote "unknown output device" message from error to debug, and change the wording to reflect what is really happening -- the display output is not connected. To generate a diff of this commit: cvs rdiff -u -r1.16 -r1.16.16.1 src/sys/dev/acpi/acpi_display.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/dev/acpi/acpi_display.c diff -u src/sys/dev/acpi/acpi_display.c:1.16 src/sys/dev/acpi/acpi_display.c:1.16.16.1 --- src/sys/dev/acpi/acpi_display.c:1.16 Thu Jun 1 02:45:09 2017 +++ src/sys/dev/acpi/acpi_display.c Wed Apr 29 13:36:57 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: acpi_display.c,v 1.16 2017/06/01 02:45:09 chs Exp $ */ +/* $NetBSD: acpi_display.c,v 1.16.16.1 2020/04/29 13:36:57 martin Exp $ */ /*- * Copyright (c) 2010 The NetBSD Foundation, Inc. @@ -66,7 +66,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: acpi_display.c,v 1.16 2017/06/01 02:45:09 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: acpi_display.c,v 1.16.16.1 2020/04/29 13:36:57 martin Exp $"); #include #include @@ -1549,8 +1549,8 @@ acpidisp_vga_bind_outdevs(struct acpidis } } if (i == oi->oi_dev_count) - aprint_error_dev(asc->sc_dev, - "unknown output device %s\n", + aprint_debug_dev(asc->sc_dev, + "output device %s not connected\n", device_xname(osc->sc_dev)); } }
CVS commit: [netbsd-9] src/sys/dev/acpi
Module Name:src
Committed By: martin
Date: Wed Apr 29 13:33:36 UTC 2020
Modified Files:
src/sys/dev/acpi [netbsd-9]: acpi_ec.c
Log Message:
Pull up following revision(s) (requested by jmcneill in ticket #866):
sys/dev/acpi/acpi_ec.c: revision 1.82
kern/55206: acpibat reporting broken by acpi_ec.c r1.81
Assume byte instead of qword alignment of the buffer passed to the EC
space handler.
To generate a diff of this commit:
cvs rdiff -u -r1.75.20.2 -r1.75.20.3 src/sys/dev/acpi/acpi_ec.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/acpi/acpi_ec.c
diff -u src/sys/dev/acpi/acpi_ec.c:1.75.20.2 src/sys/dev/acpi/acpi_ec.c:1.75.20.3
--- src/sys/dev/acpi/acpi_ec.c:1.75.20.2 Sun Apr 12 08:48:56 2020
+++ src/sys/dev/acpi/acpi_ec.c Wed Apr 29 13:33:35 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_ec.c,v 1.75.20.2 2020/04/12 08:48:56 martin Exp $ */
+/* $NetBSD: acpi_ec.c,v 1.75.20.3 2020/04/29 13:33:35 martin Exp $ */
/*-
* Copyright (c) 2007 Joerg Sonnenberger .
@@ -59,7 +59,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.75.20.2 2020/04/12 08:48:56 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.75.20.3 2020/04/29 13:33:35 martin Exp $");
#include
#include
@@ -659,32 +659,30 @@ acpiec_space_handler(uint32_t func, ACPI
{
device_t dv;
ACPI_STATUS rv;
- uint8_t addr, reg;
+ uint8_t addr, *buf;
unsigned int i;
- if (paddr > 0xff || width % 8 != 0 || width > sizeof(ACPI_INTEGER)*8 ||
+ if (paddr > 0xff || width % 8 != 0 ||
value == NULL || arg == NULL || paddr + width / 8 > 0x100)
return AE_BAD_PARAMETER;
addr = paddr;
dv = arg;
+ buf = (uint8_t *)value;
rv = AE_OK;
switch (func) {
case ACPI_READ:
- *value = 0;
- for (i = 0; i < width; i += 8, ++addr) {
- rv = acpiec_read(dv, addr, );
+ for (i = 0; i < width; i += 8, ++addr, ++buf) {
+ rv = acpiec_read(dv, addr, buf);
if (rv != AE_OK)
break;
- *value |= (ACPI_INTEGER)reg << i;
}
break;
case ACPI_WRITE:
- for (i = 0; i < width; i += 8, ++addr) {
- reg = (*value >> i) & 0xff;
- rv = acpiec_write(dv, addr, reg);
+ for (i = 0; i < width; i += 8, ++addr, ++buf) {
+ rv = acpiec_write(dv, addr, *buf);
if (rv != AE_OK)
break;
}
CVS commit: [netbsd-9] src/sys/dev/acpi
Module Name:src
Committed By: martin
Date: Sun Apr 12 08:48:57 UTC 2020
Modified Files:
src/sys/dev/acpi [netbsd-9]: acpi_ec.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #829):
sys/dev/acpi/acpi_ec.c: revision 1.78
sys/dev/acpi/acpi_ec.c: revision 1.79
sys/dev/acpi/acpi_ec.c: revision 1.80
sys/dev/acpi/acpi_ec.c: revision 1.81
Revert acpi_ec.c 1.77.
We will do this another way.
ok msaitoh
Revert acpi_ec.c 1.76.
We will do this another way, and separate KNF fixes from the critical
functional change.
ok msaitoh
KNF
Reject overly large widths, from mlelstv.
We are returning an ACPI_INTEGER (= uint64_t), so it doesn't make
sense to handle more than 64 bits.
Apparently there are some ACPIs out there that ask for unreasonably
large widths here. Just reject those requests, rather than writing
past the caller's stack buffer.
Previously we attempted to fix this by copying byte by byte as large
as the caller asked, in order to avoid the undefined behaviour of
shifting past the size of ACPI_INTEGER, but that just turned a shift
(which might have been harmless on real machines) into a stack buffer
overflow (!).
ok msaitoh
To generate a diff of this commit:
cvs rdiff -u -r1.75.20.1 -r1.75.20.2 src/sys/dev/acpi/acpi_ec.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/acpi/acpi_ec.c
diff -u src/sys/dev/acpi/acpi_ec.c:1.75.20.1 src/sys/dev/acpi/acpi_ec.c:1.75.20.2
--- src/sys/dev/acpi/acpi_ec.c:1.75.20.1 Fri Aug 9 16:13:35 2019
+++ src/sys/dev/acpi/acpi_ec.c Sun Apr 12 08:48:56 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_ec.c,v 1.75.20.1 2019/08/09 16:13:35 martin Exp $ */
+/* $NetBSD: acpi_ec.c,v 1.75.20.2 2020/04/12 08:48:56 martin Exp $ */
/*-
* Copyright (c) 2007 Joerg Sonnenberger .
@@ -59,7 +59,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.75.20.1 2019/08/09 16:13:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.75.20.2 2020/04/12 08:48:56 martin Exp $");
#include
#include
@@ -657,36 +657,42 @@ static ACPI_STATUS
acpiec_space_handler(uint32_t func, ACPI_PHYSICAL_ADDRESS paddr,
uint32_t width, ACPI_INTEGER *value, void *arg, void *region_arg)
{
- device_t dv = arg;
+ device_t dv;
ACPI_STATUS rv;
- uint8_t addr;
- uint8_t *reg;
+ uint8_t addr, reg;
+ unsigned int i;
- if ((func != ACPI_READ) && (func != ACPI_WRITE)) {
- aprint_error("%s: invalid Address Space function called: %x\n",
- device_xname(dv), (unsigned int)func);
- return AE_BAD_PARAMETER;
- }
- if (paddr > 0xff || width % 8 != 0 || value == NULL || arg == NULL ||
- paddr + width / 8 > 0x100)
+ if (paddr > 0xff || width % 8 != 0 || width > sizeof(ACPI_INTEGER)*8 ||
+ value == NULL || arg == NULL || paddr + width / 8 > 0x100)
return AE_BAD_PARAMETER;
addr = paddr;
- reg = (uint8_t *)value;
+ dv = arg;
rv = AE_OK;
- if (func == ACPI_READ)
+ switch (func) {
+ case ACPI_READ:
*value = 0;
-
- for (addr = paddr; addr < (paddr + width / 8); addr++, reg++) {
- if (func == ACPI_READ)
- rv = acpiec_read(dv, addr, reg);
- else
- rv = acpiec_write(dv, addr, *reg);
-
- if (rv != AE_OK)
- break;
+ for (i = 0; i < width; i += 8, ++addr) {
+ rv = acpiec_read(dv, addr, );
+ if (rv != AE_OK)
+break;
+ *value |= (ACPI_INTEGER)reg << i;
+ }
+ break;
+ case ACPI_WRITE:
+ for (i = 0; i < width; i += 8, ++addr) {
+ reg = (*value >> i) & 0xff;
+ rv = acpiec_write(dv, addr, reg);
+ if (rv != AE_OK)
+break;
+ }
+ break;
+ default:
+ aprint_error("%s: invalid Address Space function called: %x\n",
+ device_xname(dv), (unsigned int)func);
+ return AE_BAD_PARAMETER;
}
return rv;
CVS commit: [netbsd-9] src/sys/dev/acpi
Module Name:src
Committed By: martin
Date: Sun Mar 8 11:03:19 UTC 2020
Modified Files:
src/sys/dev/acpi [netbsd-9]: acpi_pci_link.c
Log Message:
Pull up following revision(s) (requested by chs in ticket #765):
sys/dev/acpi/acpi_pci_link.c: revision 1.25
apply FreeBSD revs r214848 and r214849:
r214849 | jkim | 2010-11-05 13:24:26 -0700 (Fri, 05 Nov 2010) | 2 lines
Add a forgotten change from the previous commit.
r214848 | jkim | 2010-11-05 12:50:09 -0700 (Fri, 05 Nov 2010) | 13 lines
Fix a use-after-free bug for extended IRQ resource[1]. When _PRS buffer is
copied as a template for _SRS, a string pointer for descriptor name is also
copied and it becomes stale as soon as it gets de-allocated[2]. Now _CRS is
used as a template for _SRS as ACPI specification suggests if it is usable.
The template from _PRS is still utilized but only when _CRS is not available
or broken. To avoid use-after-free the problem in this case, however, only
mandatory fields are copied, optional data is removed, and structure length
is adjusted accordingly.
Reported by:hps[1]
Analyzed by:avg[2]
Tested by: hps
This also fixes reading past the end of a structure as detected by KASAN.
To generate a diff of this commit:
cvs rdiff -u -r1.22 -r1.22.26.1 src/sys/dev/acpi/acpi_pci_link.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/acpi/acpi_pci_link.c
diff -u src/sys/dev/acpi/acpi_pci_link.c:1.22 src/sys/dev/acpi/acpi_pci_link.c:1.22.26.1
--- src/sys/dev/acpi/acpi_pci_link.c:1.22 Sun Sep 14 19:54:05 2014
+++ src/sys/dev/acpi/acpi_pci_link.c Sun Mar 8 11:03:19 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: acpi_pci_link.c,v 1.22 2014/09/14 19:54:05 mrg Exp $ */
+/* $NetBSD: acpi_pci_link.c,v 1.22.26.1 2020/03/08 11:03:19 martin Exp $ */
/*-
* Copyright (c) 2002 Mitsuru IWASAKI
@@ -27,7 +27,7 @@
*/
#include
-__KERNEL_RCSID(0, "$NetBSD: acpi_pci_link.c,v 1.22 2014/09/14 19:54:05 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: acpi_pci_link.c,v 1.22.26.1 2020/03/08 11:03:19 martin Exp $");
#include
#include
@@ -255,6 +255,7 @@ link_add_crs(ACPI_RESOURCE *res, void *c
static ACPI_STATUS
link_add_prs(ACPI_RESOURCE *res, void *context)
{
+ ACPI_RESOURCE *tmp;
struct link_res_request *req;
struct link *link;
uint8_t *irqs = NULL;
@@ -301,32 +302,28 @@ link_add_prs(ACPI_RESOURCE *res, void *c
req->res_index++;
/*
- * Stash a copy of the resource for later use when
- * doing _SRS.
- *
- * Note that in theory res->Length may exceed the size
- * of ACPI_RESOURCE, due to variable length lists in
- * subtypes. However, all uses of l_prs_template only
- * rely on lists lengths of zero or one, for which
- * sizeof(ACPI_RESOURCE) is sufficient space anyway.
- * We cannot read longer than Length bytes, in case we
- * read off the end of mapped memory. So we read
- * whichever length is shortest, Length or
- * sizeof(ACPI_RESOURCE).
+ * Stash a copy of the resource for later use when doing
+ * _SRS.
*/
- KASSERT(res->Length >= ACPI_RS_SIZE_MIN);
+ tmp = >l_prs_template;
+ if (is_ext_irq) {
+ memcpy(tmp, res, ACPI_RS_SIZE(tmp->Data.ExtendedIrq));
- memset(>l_prs_template, 0, sizeof(link->l_prs_template));
- memcpy(>l_prs_template, res,
- MIN(res->Length, sizeof(link->l_prs_template)));
+ /*
+ * XXX acpi_AppendBufferResource() cannot handle
+ * optional data.
+ */
+ memset(>Data.ExtendedIrq.ResourceSource, 0,
+ sizeof(tmp->Data.ExtendedIrq.ResourceSource));
+ tmp->Length = ACPI_RS_SIZE(tmp->Data.ExtendedIrq);
- if (is_ext_irq) {
link->l_num_irqs =
res->Data.ExtendedIrq.InterruptCount;
link->l_trig = res->Data.ExtendedIrq.Triggering;
link->l_pol = res->Data.ExtendedIrq.Polarity;
ext_irqs = res->Data.ExtendedIrq.Interrupts;
} else {
+ memcpy(tmp, res, ACPI_RS_SIZE(tmp->Data.Irq));
link->l_num_irqs = res->Data.Irq.InterruptCount;
link->l_trig = res->Data.Irq.Triggering;
link->l_pol = res->Data.Irq.Polarity;
@@ -737,17 +734,16 @@ acpi_pci_link_add_reference(void *v, int
static ACPI_STATUS
acpi_pci_link_srs_from_crs(struct acpi_pci_link_softc *sc, ACPI_BUFFER *srsbuf)
{
- ACPI_RESOURCE *resource, *end, newres, *resptr;
- ACPI_BUFFER crsbuf;
+ ACPI_RESOURCE *end, *res;
ACPI_STATUS status;
struct link *link;
int i, in_dpf;
/* Fetch the _CRS. */
- crsbuf.Pointer = NULL;
- crsbuf.Length = ACPI_ALLOCATE_LOCAL_BUFFER;
- status = AcpiGetCurrentResources(sc->pl_handle, );
- if (ACPI_SUCCESS(status) && crsbuf.Pointer == NULL)
+ srsbuf->Pointer = NULL;
+ srsbuf->Length = ACPI_ALLOCATE_BUFFER;
+ status = AcpiGetCurrentResources(sc->pl_handle, srsbuf);
+ if (ACPI_SUCCESS(status) && srsbuf->Pointer == NULL)
status = AE_NO_MEMORY;
if (ACPI_FAILURE(status)) {
aprint_verbose("%s: Unable to fetch current resources:
