--- /dev/null
+From f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 22 Nov 2019 19:56:41 +0100
+Subject: platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c upstream.
+
+The AML code implementing the WMI methods creates a variable length
+field to hold the input data we pass like this:
+
+ CreateDWordField (Arg1, 0x0C, DSZI)
+ Local5 = DSZI /* \HWMC.DSZI */
+ CreateField (Arg1, 0x80, (Local5 * 0x08), DAIN)
+
+If we pass 0 as bios_args.datasize argument then (Local5 * 0x08)
+is 0 which results in these errors:
+
+[ 71.973305] ACPI BIOS Error (bug): Attempt to CreateField of length zero (20190816/dsopcode-133)
+[ 71.973332] ACPI Error: Aborting method \HWMC due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529)
+[ 71.973413] ACPI Error: Aborting method \_SB.WMID.WMAA due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529)
+
+And in our HPWMI_WIRELESS2_QUERY calls always failing. for read commands
+like HPWMI_WIRELESS2_QUERY the DSZI value is not used / checked, except for
+read commands where extra input is needed to specify exactly what to read.
+
+So for HPWMI_WIRELESS2_QUERY we can safely pass the size of the expected
+output as insize to hp_wmi_perform_query(), as we are already doing for all
+other HPWMI_READ commands we send. Doing so fixes these errors.
+
+Cc: stable@vger.kernel.org
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/hp-wmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -380,7 +380,7 @@ static int hp_wmi_rfkill2_refresh(void)
+ int err, i;
+
+ err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state,
+- 0, sizeof(state));
++ sizeof(state), sizeof(state));
+ if (err)
+ return err;
+
+@@ -777,7 +777,7 @@ static int __init hp_wmi_rfkill2_setup(s
+ int err, i;
+
+ err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state,
+- 0, sizeof(state));
++ sizeof(state), sizeof(state));
+ if (err)
+ return err < 0 ? err : -EINVAL;
+
--- /dev/null
+From 16245db1489cd9aa579506f64afeeeb13d825a93 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 22 Nov 2019 19:56:40 +0100
+Subject: platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 16245db1489cd9aa579506f64afeeeb13d825a93 upstream.
+
+The HP WMI calls may take up to 128 bytes of data as input, and
+the AML methods implementing the WMI calls, declare a couple of fields for
+accessing input in different sizes, specifycally the HWMC method contains:
+
+ CreateField (Arg1, 0x80, 0x0400, D128)
+
+Even though we do not use any of the WMI command-types which need a buffer
+of this size, the APCI interpreter still tries to create it as it is
+declared in generoc code at the top of the HWMC method which runs before
+the code looks at which command-type is requested.
+
+This results in many of these errors on many different HP laptop models:
+
+[ 14.459261] ACPI Error: Field [D128] at 1152 exceeds Buffer [NULL] size 160 (bits) (20170303/dsopcode-236)
+[ 14.459268] ACPI Error: Method parse/execution failed [\HWMC] (Node ffff8edcc61507f8), AE_AML_BUFFER_LIMIT (20170303/psparse-543)
+[ 14.459279] ACPI Error: Method parse/execution failed [\_SB.WMID.WMAA] (Node ffff8edcc61523c0), AE_AML_BUFFER_LIMIT (20170303/psparse-543)
+
+This commit increases the size of the data element of the bios_args struct
+to 128 bytes fixing these errors.
+
+Cc: stable@vger.kernel.org
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/hp-wmi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -65,7 +65,7 @@ struct bios_args {
+ u32 command;
+ u32 commandtype;
+ u32 datasize;
+- u32 data;
++ u8 data[128];
+ };
+
+ enum hp_wmi_commandtype {
+@@ -216,7 +216,7 @@ static int hp_wmi_perform_query(int quer
+ .command = command,
+ .commandtype = query,
+ .datasize = insize,
+- .data = 0,
++ .data = { 0 },
+ };
+ struct acpi_buffer input = { sizeof(struct bios_args), &args };
+ struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+@@ -228,7 +228,7 @@ static int hp_wmi_perform_query(int quer
+
+ if (WARN_ON(insize > sizeof(args.data)))
+ return -EINVAL;
+- memcpy(&args.data, buffer, insize);
++ memcpy(&args.data[0], buffer, insize);
+
+ wmi_evaluate_method(HPWMI_BIOS_GUID, 0, mid, &input, &output);
+
selftests-pmtu-use-oneline-for-ip-route-list-cache.patch
ext4-add-more-paranoia-checking-in-ext4_expand_extra_isize-handling.patch
hid-core-check-whether-usage-page-item-is-after-usage-id-items.patch
+platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch
+platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input-size.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
