From 0e5a99ee816f1e5f6ae2cd75e3ab7113aca7a4a0 Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Wed, 26 Mar 2025 21:07:57 +0100 Subject: [PATCH 01/23] ACPICA: actbl1: Update values to hex to follow ACPI specs ANBZ: #31912 commit 5d2f7e76b70121fe06fd12315a6ea439e3bf0414 upstream. ACPICA commit 0b44ed75fb551bf3fbbbd39ca72bd932872fff20 ACPI specs(1) define Error Injection Actions in hex values. This commit intends to update values from decimal to hex to be consistent with ACPI specs. Intel-SIG: commit 5d2f7e76b701 ACPICA: actbl1: Update values to hex to follow ACPI specs Backport APEI EINJ V2 support Link: https://uefi.org/specs/ACPI/6.5/18_Platform_Error_Interfaces.html (1) Link: https://github.com/acpica/acpica/commit/0b44ed75 Signed-off-by: Zaid Alali Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/13729719.uLZWGnKmhe@rjwysocki.net [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- include/acpi/actbl1.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/include/acpi/actbl1.h b/include/acpi/actbl1.h index b9b9a46fc76f..a8bc3cab4411 100644 --- a/include/acpi/actbl1.h +++ b/include/acpi/actbl1.h @@ -1047,17 +1047,17 @@ struct acpi_einj_entry { /* Values for Action field above */ enum acpi_einj_actions { - ACPI_EINJ_BEGIN_OPERATION = 0, - ACPI_EINJ_GET_TRIGGER_TABLE = 1, - ACPI_EINJ_SET_ERROR_TYPE = 2, - ACPI_EINJ_GET_ERROR_TYPE = 3, - ACPI_EINJ_END_OPERATION = 4, - ACPI_EINJ_EXECUTE_OPERATION = 5, - ACPI_EINJ_CHECK_BUSY_STATUS = 6, - ACPI_EINJ_GET_COMMAND_STATUS = 7, - ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS = 8, - ACPI_EINJ_GET_EXECUTE_TIMINGS = 9, - ACPI_EINJ_ACTION_RESERVED = 10, /* 10 and greater are reserved */ + ACPI_EINJ_BEGIN_OPERATION = 0x0, + ACPI_EINJ_GET_TRIGGER_TABLE = 0x1, + ACPI_EINJ_SET_ERROR_TYPE = 0x2, + ACPI_EINJ_GET_ERROR_TYPE = 0x3, + ACPI_EINJ_END_OPERATION = 0x4, + ACPI_EINJ_EXECUTE_OPERATION = 0x5, + ACPI_EINJ_CHECK_BUSY_STATUS = 0x6, + ACPI_EINJ_GET_COMMAND_STATUS = 0x7, + ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS = 0x8, + ACPI_EINJ_GET_EXECUTE_TIMINGS = 0x9, + ACPI_EINJ_ACTION_RESERVED = 0xA, /* 10 and greater are reserved */ ACPI_EINJ_TRIGGER_ERROR = 0xFF /* Except for this value */ }; -- Gitee From baca51d6775eb6ace5e0b56f8a3b85de95bdf299 Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Wed, 26 Mar 2025 21:08:46 +0100 Subject: [PATCH 02/23] ACPICA: actbl1: Add EINJv2 get error type action ANBZ: #31912 commit 56b594fdb6dd68d085067a69f5f78171aa6f1657 upstream. ACPICA commit 6975cd07e20ba955556e1eafe8a326834c354ae6 Add EINJV2_GET_ERROR_TYPE as defined in the new specs(1)(2). Intel-SIG: commit 56b594fdb6dd ACPICA: actbl1: Add EINJv2 get error type action Backport APEI EINJ V2 support Link: https://bugzilla.tianocore.org/show_bug.cgi?id=4615 (1) Link: https://bugzilla.tianocore.org/attachment.cgi?id=1446 (2) Link: https://github.com/acpica/acpica/commit/6975cd07 Signed-off-by: Zaid Alali Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3344273.aeNJFYEL58@rjwysocki.net [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- include/acpi/actbl1.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/acpi/actbl1.h b/include/acpi/actbl1.h index a8bc3cab4411..663a22ce0b3e 100644 --- a/include/acpi/actbl1.h +++ b/include/acpi/actbl1.h @@ -1057,7 +1057,8 @@ enum acpi_einj_actions { ACPI_EINJ_GET_COMMAND_STATUS = 0x7, ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS = 0x8, ACPI_EINJ_GET_EXECUTE_TIMINGS = 0x9, - ACPI_EINJ_ACTION_RESERVED = 0xA, /* 10 and greater are reserved */ + ACPI_EINJV2_GET_ERROR_TYPE = 0x11, + ACPI_EINJ_ACTION_RESERVED = 0x12, /* 0x12 and greater are reserved */ ACPI_EINJ_TRIGGER_ERROR = 0xFF /* Except for this value */ }; -- Gitee From 0839a9a69b75d04c4791a5087a86149d491ba78a Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 6 May 2025 14:38:08 -0700 Subject: [PATCH 03/23] ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() ANBZ: #31912 commit e54b1dc1c4f083cb66a70d8ccc866de47fc36d7a upstream. A single call to einj_get_available_error_type() in init function is sufficient to save the return value in a global variable to be used later in various places in the code. This change has no functional impact, but only removes unnecessary redundant function calls. Intel-SIG: commit e54b1dc1c4f0 ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() Backport APEI EINJ V2 support Reviewed-by: Jonathan Cameron Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250506213814.2365788-5-zaidal@os.amperecomputing.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 66e7f529e92f..96a037f7ab9f 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -83,6 +83,8 @@ static struct debugfs_blob_wrapper vendor_blob; static struct debugfs_blob_wrapper vendor_errors; static char vendor_dev[64]; +static u32 available_error_type; + /* * Some BIOSes allow parameters to the SET_ERROR_TYPE entries in the * EINJ table through an unpublished extension. Use with caution as @@ -648,14 +650,9 @@ static struct { u32 mask; const char *str; } const einj_error_type_string[] = { static int available_error_type_show(struct seq_file *m, void *v) { - int rc; - u32 error_type = 0; - rc = einj_get_available_error_type(&error_type); - if (rc) - return rc; for (int pos = 0; pos < ARRAY_SIZE(einj_error_type_string); pos++) - if (error_type & einj_error_type_string[pos].mask) + if (available_error_type & einj_error_type_string[pos].mask) seq_printf(m, "0x%08x\t%s\n", einj_error_type_string[pos].mask, einj_error_type_string[pos].str); @@ -678,8 +675,7 @@ bool einj_is_cxl_error_type(u64 type) int einj_validate_error_type(u64 type) { - u32 tval, vendor, available_error_type = 0; - int rc; + u32 tval, vendor; /* Only low 32 bits for error type are valid */ if (type & GENMASK_ULL(63, 32)) @@ -695,13 +691,9 @@ int einj_validate_error_type(u64 type) /* Only one error type can be specified */ if (tval & (tval - 1)) return -EINVAL; - if (!vendor) { - rc = einj_get_available_error_type(&available_error_type); - if (rc) - return rc; + if (!vendor) if (!(type & available_error_type)) return -EINVAL; - } return 0; } @@ -777,6 +769,10 @@ static int __init einj_probe(struct platform_device *pdev) goto err_put_table; } + rc = einj_get_available_error_type(&available_error_type); + if (rc) + return rc; + rc = -ENOMEM; einj_debug_dir = debugfs_create_dir("einj", apei_get_debugfs_dir()); -- Gitee From ee1539b83697ee6d7aa1c861e48ec483839196e0 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 27 May 2025 08:43:34 +0300 Subject: [PATCH 04/23] ACPI: APEI: EINJ: Clean up on error in einj_probe() ANBZ: #31912 commit ce57cc1269c580abfca5b79cb40243b01aac357c upstream. Call acpi_put_table() before returning the error code. Intel-SIG: commit ce57cc1269c5 ACPI: APEI: EINJ: Clean up on error in einj_probe() Backport APEI EINJ V2 support Fixes: e54b1dc1c4f0 ("ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type()") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aDVRBok33LZhXcId@stanley.mountain Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 96a037f7ab9f..69aae18be2e8 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -771,7 +771,7 @@ static int __init einj_probe(struct platform_device *pdev) rc = einj_get_available_error_type(&available_error_type); if (rc) - return rc; + goto err_put_table; rc = -ENOMEM; einj_debug_dir = debugfs_create_dir("einj", apei_get_debugfs_dir()); -- Gitee From 8fbc6f39dbce16c2685fbea62a4403d7af4152da Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 17 Jun 2025 12:30:20 -0700 Subject: [PATCH 05/23] ACPI: APEI: EINJ: Fix kernel test sparse warnings ANBZ: #31912 commit 1a35c88302a3b2827ec47f0b2d0530b543938fb3 upstream. This patch fixes the kernel test robot warning reported here: Intel-SIG: commit 1a35c88302a3 ACPI: APEI: EINJ: Fix kernel test sparse warnings Backport APEI EINJ V2 support Link: https://lore.kernel.org/all/202410241620.oApALow5-lkp@intel.com/ Use pointers annotated with the __iomem marker for all iomem map calls, and creates a local copy of the mapped IO memory for future access in the code. memcpy_fromio() and memcpy_toio() are used to read/write data from/to mapped IO memory. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-2-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 106 +++++++++++++++++++--------------- 1 file changed, 60 insertions(+), 46 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 69aae18be2e8..7cc3caf62719 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -151,7 +151,7 @@ static DEFINE_MUTEX(einj_mutex); */ bool einj_initialized __ro_after_init; -static void *einj_param; +static void __iomem *einj_param; static void einj_exec_ctx_init(struct apei_exec_context *ctx) { @@ -216,24 +216,26 @@ static void check_vendor_extension(u64 paddr, struct set_error_type_with_address *v5param) { int offset = v5param->vendor_extension; - struct vendor_error_type_extension *v; + struct vendor_error_type_extension v; + struct vendor_error_type_extension __iomem *p; u32 sbdf; if (!offset) return; - v = acpi_os_map_iomem(paddr + offset, sizeof(*v)); - if (!v) + p = acpi_os_map_iomem(paddr + offset, sizeof(*p)); + if (!p) return; - get_oem_vendor_struct(paddr, offset, v); - sbdf = v->pcie_sbdf; + memcpy_fromio(&v, p, sizeof(v)); + get_oem_vendor_struct(paddr, offset, &v); + sbdf = v.pcie_sbdf; sprintf(vendor_dev, "%x:%x:%x.%x vendor_id=%x device_id=%x rev_id=%x\n", sbdf >> 24, (sbdf >> 16) & 0xff, (sbdf >> 11) & 0x1f, (sbdf >> 8) & 0x7, - v->vendor_id, v->device_id, v->rev_id); - acpi_os_unmap_iomem(v, sizeof(*v)); + v.vendor_id, v.device_id, v.rev_id); + acpi_os_unmap_iomem(p, sizeof(v)); } -static void *einj_get_parameter_address(void) +static void __iomem *einj_get_parameter_address(void) { int i; u64 pa_v4 = 0, pa_v5 = 0; @@ -254,26 +256,30 @@ static void *einj_get_parameter_address(void) entry++; } if (pa_v5) { - struct set_error_type_with_address *v5param; + struct set_error_type_with_address v5param; + struct set_error_type_with_address __iomem *p; - v5param = acpi_os_map_iomem(pa_v5, sizeof(*v5param)); - if (v5param) { + p = acpi_os_map_iomem(pa_v5, sizeof(*p)); + if (p) { + memcpy_fromio(&v5param, p, sizeof(v5param)); acpi5 = 1; - check_vendor_extension(pa_v5, v5param); - return v5param; + check_vendor_extension(pa_v5, &v5param); + return p; } } if (param_extension && pa_v4) { - struct einj_parameter *v4param; + struct einj_parameter v4param; + struct einj_parameter __iomem *p; - v4param = acpi_os_map_iomem(pa_v4, sizeof(*v4param)); - if (!v4param) + p = acpi_os_map_iomem(pa_v4, sizeof(*p)); + if (!p) return NULL; - if (v4param->reserved1 || v4param->reserved2) { - acpi_os_unmap_iomem(v4param, sizeof(*v4param)); + memcpy_fromio(&v4param, p, sizeof(v4param)); + if (v4param.reserved1 || v4param.reserved2) { + acpi_os_unmap_iomem(p, sizeof(v4param)); return NULL; } - return v4param; + return p; } return NULL; @@ -319,7 +325,7 @@ static struct acpi_generic_address *einj_get_trigger_parameter_region( static int __einj_error_trigger(u64 trigger_paddr, u32 type, u64 param1, u64 param2) { - struct acpi_einj_trigger *trigger_tab = NULL; + struct acpi_einj_trigger trigger_tab; struct apei_exec_context trigger_ctx; struct apei_resources trigger_resources; struct acpi_whea_header *trigger_entry; @@ -327,54 +333,57 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, u32 table_size; int rc = -EIO; struct acpi_generic_address *trigger_param_region = NULL; + struct acpi_einj_trigger __iomem *p; - r = request_mem_region(trigger_paddr, sizeof(*trigger_tab), + r = request_mem_region(trigger_paddr, sizeof(trigger_tab), "APEI EINJ Trigger Table"); if (!r) { pr_err("Can not request [mem %#010llx-%#010llx] for Trigger table\n", (unsigned long long)trigger_paddr, (unsigned long long)trigger_paddr + - sizeof(*trigger_tab) - 1); + sizeof(trigger_tab) - 1); goto out; } - trigger_tab = ioremap_cache(trigger_paddr, sizeof(*trigger_tab)); - if (!trigger_tab) { + p = ioremap_cache(trigger_paddr, sizeof(*p)); + if (!p) { pr_err("Failed to map trigger table!\n"); goto out_rel_header; } - rc = einj_check_trigger_header(trigger_tab); + memcpy_fromio(&trigger_tab, p, sizeof(trigger_tab)); + rc = einj_check_trigger_header(&trigger_tab); if (rc) { pr_warn(FW_BUG "Invalid trigger error action table.\n"); goto out_rel_header; } /* No action structures in the TRIGGER_ERROR table, nothing to do */ - if (!trigger_tab->entry_count) + if (!trigger_tab.entry_count) goto out_rel_header; rc = -EIO; - table_size = trigger_tab->table_size; - r = request_mem_region(trigger_paddr + sizeof(*trigger_tab), - table_size - sizeof(*trigger_tab), + table_size = trigger_tab.table_size; + r = request_mem_region(trigger_paddr + sizeof(trigger_tab), + table_size - sizeof(trigger_tab), "APEI EINJ Trigger Table"); if (!r) { pr_err("Can not request [mem %#010llx-%#010llx] for Trigger Table Entry\n", - (unsigned long long)trigger_paddr + sizeof(*trigger_tab), + (unsigned long long)trigger_paddr + sizeof(trigger_tab), (unsigned long long)trigger_paddr + table_size - 1); goto out_rel_header; } - iounmap(trigger_tab); - trigger_tab = ioremap_cache(trigger_paddr, table_size); - if (!trigger_tab) { + iounmap(p); + p = ioremap_cache(trigger_paddr, table_size); + if (!p) { pr_err("Failed to map trigger table!\n"); goto out_rel_entry; } + memcpy_fromio(&trigger_tab, p, sizeof(trigger_tab)); trigger_entry = (struct acpi_whea_header *) - ((char *)trigger_tab + sizeof(struct acpi_einj_trigger)); + ((char *)&trigger_tab + sizeof(struct acpi_einj_trigger)); apei_resources_init(&trigger_resources); apei_exec_ctx_init(&trigger_ctx, einj_ins_type, ARRAY_SIZE(einj_ins_type), - trigger_entry, trigger_tab->entry_count); + trigger_entry, trigger_tab.entry_count); rc = apei_exec_collect_resources(&trigger_ctx, &trigger_resources); if (rc) goto out_fini; @@ -392,7 +401,7 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, apei_resources_init(&addr_resources); trigger_param_region = einj_get_trigger_parameter_region( - trigger_tab, param1, param2); + &trigger_tab, param1, param2); if (trigger_param_region) { rc = apei_resources_add(&addr_resources, trigger_param_region->address, @@ -421,13 +430,13 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, out_fini: apei_resources_fini(&trigger_resources); out_rel_entry: - release_mem_region(trigger_paddr + sizeof(*trigger_tab), - table_size - sizeof(*trigger_tab)); + release_mem_region(trigger_paddr + sizeof(trigger_tab), + table_size - sizeof(trigger_tab)); out_rel_header: - release_mem_region(trigger_paddr, sizeof(*trigger_tab)); + release_mem_region(trigger_paddr, sizeof(trigger_tab)); out: - if (trigger_tab) - iounmap(trigger_tab); + if (p) + iounmap(p); return rc; } @@ -446,8 +455,10 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, return rc; apei_exec_ctx_set_input(&ctx, type); if (acpi5) { - struct set_error_type_with_address *v5param = einj_param; + struct set_error_type_with_address *v5param, v5_struct; + v5param = &v5_struct; + memcpy_fromio(v5param, einj_param, sizeof(*v5param)); v5param->type = type; if (type & ACPI5_VENDOR_BIT) { switch (vendor_flags) { @@ -492,15 +503,18 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, break; } } + memcpy_toio(einj_param, v5param, sizeof(*v5param)); } else { rc = apei_exec_run(&ctx, ACPI_EINJ_SET_ERROR_TYPE); if (rc) return rc; if (einj_param) { - struct einj_parameter *v4param = einj_param; + struct einj_parameter v4param; - v4param->param1 = param1; - v4param->param2 = param2; + memcpy_fromio(&v4param, einj_param, sizeof(v4param)); + v4param.param1 = param1; + v4param.param2 = param2; + memcpy_toio(einj_param, &v4param, sizeof(v4param)); } } rc = apei_exec_run(&ctx, ACPI_EINJ_EXECUTE_OPERATION); -- Gitee From 9a53ecebce39321d67d8ab2c5437a8067a1e1dba Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Thu, 3 Jul 2025 13:04:21 -0700 Subject: [PATCH 06/23] ACPI: APEI: EINJ: Fix trigger actions ANBZ: #31912 commit c8aea83c735ec5a853db495592a1b6b5e6db859b upstream. The trigger events are in BIOS memory immediately following the acpi_einj_trigger structure. These were not copied to regular kernel memory for use by apei_exec_ctx_init() so injections in "notrigger=0" mode failed with a message like this: APEI: Invalid action table, unknown instruction type: 123 Fix by allocating a "table_size" block of memory and copying the whole table for use in the rest of the trigger flow. Intel-SIG: commit c8aea83c735e ACPI: APEI: EINJ: Fix trigger actions Backport APEI EINJ V2 support Fixes: 1a35c88302a3 ("ACPI: APEI: EINJ: Fix kernel test sparse warnings") Reported-by: Yi1 Lai Signed-off-by: Tony Luck Link: https://patch.msgid.link/20250703200421.28012-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 7cc3caf62719..0a26ebcd4162 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -326,6 +326,7 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, u64 param1, u64 param2) { struct acpi_einj_trigger trigger_tab; + struct acpi_einj_trigger *full_trigger_tab; struct apei_exec_context trigger_ctx; struct apei_resources trigger_resources; struct acpi_whea_header *trigger_entry; @@ -362,6 +363,9 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, rc = -EIO; table_size = trigger_tab.table_size; + full_trigger_tab = kmalloc(table_size, GFP_KERNEL); + if (!full_trigger_tab) + goto out_rel_header; r = request_mem_region(trigger_paddr + sizeof(trigger_tab), table_size - sizeof(trigger_tab), "APEI EINJ Trigger Table"); @@ -369,7 +373,7 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, pr_err("Can not request [mem %#010llx-%#010llx] for Trigger Table Entry\n", (unsigned long long)trigger_paddr + sizeof(trigger_tab), (unsigned long long)trigger_paddr + table_size - 1); - goto out_rel_header; + goto out_free_trigger_tab; } iounmap(p); p = ioremap_cache(trigger_paddr, table_size); @@ -377,9 +381,9 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, pr_err("Failed to map trigger table!\n"); goto out_rel_entry; } - memcpy_fromio(&trigger_tab, p, sizeof(trigger_tab)); + memcpy_fromio(full_trigger_tab, p, table_size); trigger_entry = (struct acpi_whea_header *) - ((char *)&trigger_tab + sizeof(struct acpi_einj_trigger)); + ((char *)full_trigger_tab + sizeof(struct acpi_einj_trigger)); apei_resources_init(&trigger_resources); apei_exec_ctx_init(&trigger_ctx, einj_ins_type, ARRAY_SIZE(einj_ins_type), @@ -401,7 +405,7 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, apei_resources_init(&addr_resources); trigger_param_region = einj_get_trigger_parameter_region( - &trigger_tab, param1, param2); + full_trigger_tab, param1, param2); if (trigger_param_region) { rc = apei_resources_add(&addr_resources, trigger_param_region->address, @@ -432,6 +436,8 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, out_rel_entry: release_mem_region(trigger_paddr + sizeof(trigger_tab), table_size - sizeof(trigger_tab)); +out_free_trigger_tab: + kfree(full_trigger_tab); out_rel_header: release_mem_region(trigger_paddr, sizeof(trigger_tab)); out: -- Gitee From 6f061f4495089662134bef3b9c3239581d813b4e Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 17 Jun 2025 12:30:21 -0700 Subject: [PATCH 07/23] ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities ANBZ: #31912 commit 0c6176e1e1862fd09484c50de17c04b3ca388c22 upstream. Enable the driver to show all supported error injections for EINJ and EINJv2 at the same time. EINJv2 capabilities can be discovered by checking the return value of get_error_type, where bit 30 set indicates EINJv2 support. Intel-SIG: commit 0c6176e1e186 ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities Backport APEI EINJ V2 support Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-3-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/einj-core.c | 75 +++++++++++++++++++++++++------ drivers/acpi/apei/einj-cxl.c | 2 +- 3 files changed, 63 insertions(+), 16 deletions(-) diff --git a/drivers/acpi/apei/apei-internal.h b/drivers/acpi/apei/apei-internal.h index b4ea68357e24..76f74a80c32d 100644 --- a/drivers/acpi/apei/apei-internal.h +++ b/drivers/acpi/apei/apei-internal.h @@ -131,7 +131,7 @@ static inline u32 cper_estatus_len(struct acpi_hest_generic_status *estatus) int apei_osc_setup(void); -int einj_get_available_error_type(u32 *type); +int einj_get_available_error_type(u32 *type, int einj_action); int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, u64 param4); int einj_cxl_rch_error_inject(u32 type, u32 flags, u64 param1, u64 param2, diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 0a26ebcd4162..bc58a2be8675 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -33,6 +33,7 @@ #define SLEEP_UNIT_MAX 5000 /* 5ms */ /* Firmware should respond within 1 seconds */ #define FIRMWARE_TIMEOUT (1 * USEC_PER_SEC) +#define ACPI65_EINJV2_SUPP BIT(30) #define ACPI5_VENDOR_BIT BIT(31) #define MEM_ERROR_MASK (ACPI_EINJ_MEMORY_CORRECTABLE | \ ACPI_EINJ_MEMORY_UNCORRECTABLE | \ @@ -84,6 +85,7 @@ static struct debugfs_blob_wrapper vendor_errors; static char vendor_dev[64]; static u32 available_error_type; +static u32 available_error_type_v2; /* * Some BIOSes allow parameters to the SET_ERROR_TYPE entries in the @@ -159,13 +161,13 @@ static void einj_exec_ctx_init(struct apei_exec_context *ctx) EINJ_TAB_ENTRY(einj_tab), einj_tab->entries); } -static int __einj_get_available_error_type(u32 *type) +static int __einj_get_available_error_type(u32 *type, int einj_action) { struct apei_exec_context ctx; int rc; einj_exec_ctx_init(&ctx); - rc = apei_exec_run(&ctx, ACPI_EINJ_GET_ERROR_TYPE); + rc = apei_exec_run(&ctx, einj_action); if (rc) return rc; *type = apei_exec_ctx_get_output(&ctx); @@ -174,17 +176,34 @@ static int __einj_get_available_error_type(u32 *type) } /* Get error injection capabilities of the platform */ -int einj_get_available_error_type(u32 *type) +int einj_get_available_error_type(u32 *type, int einj_action) { int rc; mutex_lock(&einj_mutex); - rc = __einj_get_available_error_type(type); + rc = __einj_get_available_error_type(type, einj_action); mutex_unlock(&einj_mutex); return rc; } +static int einj_get_available_error_types(u32 *type1, u32 *type2) +{ + int rc; + + rc = einj_get_available_error_type(type1, ACPI_EINJ_GET_ERROR_TYPE); + if (rc) + return rc; + if (*type1 & ACPI65_EINJV2_SUPP) { + rc = einj_get_available_error_type(type2, + ACPI_EINJV2_GET_ERROR_TYPE); + if (rc) + return rc; + } + + return 0; +} + static int einj_timedout(u64 *t) { if ((s64)*t < SLEEP_UNIT_MIN) { @@ -652,6 +671,7 @@ static u64 error_param2; static u64 error_param3; static u64 error_param4; static struct dentry *einj_debug_dir; +static char einj_buf[32]; static struct { u32 mask; const char *str; } const einj_error_type_string[] = { { BIT(0), "Processor Correctable" }, { BIT(1), "Processor Uncorrectable non-fatal" }, @@ -668,6 +688,12 @@ static struct { u32 mask; const char *str; } const einj_error_type_string[] = { { BIT(31), "Vendor Defined Error Types" }, }; +static struct { u32 mask; const char *str; } const einjv2_error_type_string[] = { + { BIT(0), "EINJV2 Processor Error" }, + { BIT(1), "EINJV2 Memory Error" }, + { BIT(2), "EINJV2 PCI Express Error" }, +}; + static int available_error_type_show(struct seq_file *m, void *v) { @@ -675,17 +701,22 @@ static int available_error_type_show(struct seq_file *m, void *v) if (available_error_type & einj_error_type_string[pos].mask) seq_printf(m, "0x%08x\t%s\n", einj_error_type_string[pos].mask, einj_error_type_string[pos].str); - + if (available_error_type & ACPI65_EINJV2_SUPP) { + for (int pos = 0; pos < ARRAY_SIZE(einjv2_error_type_string); pos++) { + if (available_error_type_v2 & einjv2_error_type_string[pos].mask) + seq_printf(m, "V2_0x%08x\t%s\n", einjv2_error_type_string[pos].mask, + einjv2_error_type_string[pos].str); + } + } return 0; } DEFINE_SHOW_ATTRIBUTE(available_error_type); -static int error_type_get(void *data, u64 *val) +static ssize_t error_type_get(struct file *file, char __user *buf, + size_t count, loff_t *ppos) { - *val = error_type; - - return 0; + return simple_read_from_buffer(buf, count, ppos, einj_buf, strlen(einj_buf)); } bool einj_is_cxl_error_type(u64 type) @@ -718,9 +749,23 @@ int einj_validate_error_type(u64 type) return 0; } -static int error_type_set(void *data, u64 val) +static ssize_t error_type_set(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) { int rc; + u64 val; + + memset(einj_buf, 0, sizeof(einj_buf)); + if (copy_from_user(einj_buf, buf, count)) + return -EFAULT; + + if (strncmp(einj_buf, "V2_", 3) == 0) { + if (!sscanf(einj_buf, "V2_%llx", &val)) + return -EINVAL; + } else { + if (!sscanf(einj_buf, "%llx", &val)) + return -EINVAL; + } rc = einj_validate_error_type(val); if (rc) @@ -728,11 +773,13 @@ static int error_type_set(void *data, u64 val) error_type = val; - return 0; + return count; } -DEFINE_DEBUGFS_ATTRIBUTE(error_type_fops, error_type_get, error_type_set, - "0x%llx\n"); +static const struct file_operations error_type_fops = { + .read = error_type_get, + .write = error_type_set, +}; static int error_inject_set(void *data, u64 val) { @@ -789,7 +836,7 @@ static int __init einj_probe(struct platform_device *pdev) goto err_put_table; } - rc = einj_get_available_error_type(&available_error_type); + rc = einj_get_available_error_types(&available_error_type, &available_error_type_v2); if (rc) goto err_put_table; diff --git a/drivers/acpi/apei/einj-cxl.c b/drivers/acpi/apei/einj-cxl.c index 8b8be0c90709..25adc9b03d18 100644 --- a/drivers/acpi/apei/einj-cxl.c +++ b/drivers/acpi/apei/einj-cxl.c @@ -30,7 +30,7 @@ int einj_cxl_available_error_type_show(struct seq_file *m, void *v) int cxl_err, rc; u32 available_error_type = 0; - rc = einj_get_available_error_type(&available_error_type); + rc = einj_get_available_error_type(&available_error_type, ACPI_EINJ_GET_ERROR_TYPE); if (rc) return rc; -- Gitee From 001ee1b427679c3a1d96f2f787ed42df8130910b Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 17 Jun 2025 12:30:22 -0700 Subject: [PATCH 08/23] ACPI: APEI: EINJ: Add einjv2 extension struct ANBZ: #31912 commit 21cd921b1a5a4c8d0097343bda7e6e78d21e9773 upstream. Add einjv2 extension struct and EINJv2 error types to prepare the driver for EINJv2 support. ACPI specifications[1] enables EINJv2 by extending set_error_type_with_address struct. Intel-SIG: commit 21cd921b1a5a ACPI: APEI: EINJ: Add einjv2 extension struct Backport APEI EINJ V2 support Link: https://uefi.org/specs/ACPI/6.6/18_Platform_Error_Interfaces.html#einjv2-extension-structure [1] Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-4-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index bc58a2be8675..4d34737ddc77 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -33,6 +33,7 @@ #define SLEEP_UNIT_MAX 5000 /* 5ms */ /* Firmware should respond within 1 seconds */ #define FIRMWARE_TIMEOUT (1 * USEC_PER_SEC) +#define COMPONENT_LEN 16 #define ACPI65_EINJV2_SUPP BIT(30) #define ACPI5_VENDOR_BIT BIT(31) #define MEM_ERROR_MASK (ACPI_EINJ_MEMORY_CORRECTABLE | \ @@ -50,6 +51,28 @@ */ static int acpi5; +struct syndrome_array { + union { + u8 acpi_id[COMPONENT_LEN]; + u8 device_id[COMPONENT_LEN]; + u8 pcie_sbdf[COMPONENT_LEN]; + u8 vendor_id[COMPONENT_LEN]; + } comp_id; + union { + u8 proc_synd[COMPONENT_LEN]; + u8 mem_synd[COMPONENT_LEN]; + u8 pcie_synd[COMPONENT_LEN]; + u8 vendor_synd[COMPONENT_LEN]; + } comp_synd; +}; + +struct einjv2_extension_struct { + u32 length; + u16 revision; + u16 component_arr_count; + struct syndrome_array component_arr[] __counted_by(component_arr_count); +}; + struct set_error_type_with_address { u32 type; u32 vendor_extension; @@ -58,6 +81,7 @@ struct set_error_type_with_address { u64 memory_address; u64 memory_address_range; u32 pcie_sbdf; + struct einjv2_extension_struct einjv2_struct; }; enum { SETWA_FLAGS_APICID = 1, -- Gitee From 1a2dbd7bf296f3f880a798004f6e7a46f3e0c499 Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 17 Jun 2025 12:30:23 -0700 Subject: [PATCH 09/23] ACPI: APEI: EINJ: Discover EINJv2 parameters ANBZ: #31912 commit 691a0f0a557b19316ef533f9ca34c72ab6c7ae56 upstream. The EINJv2 set_error_type_with_address structure has a flex array to hold the component IDs and syndrome values used when injecting multiple errors at once. Discover the size of this array by taking the address from the ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS entry in the EINJ table and reading the BIOS copy of the structure. Derive the maximum number of components from the length field in the einjv2_extension_struct at the end of the BIOS copy. Map the whole of the structure into kernel memory (and unmap on module unload). [Tony: Code unchanged from Zaid's original. New commit message] Intel-SIG: commit 691a0f0a557b ACPI: APEI: EINJ: Discover EINJv2 parameters Backport APEI EINJ V2 support Reviewed-by: Tony Luck Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-5-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 4d34737ddc77..a2ad638440f0 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -108,6 +108,7 @@ static struct debugfs_blob_wrapper vendor_blob; static struct debugfs_blob_wrapper vendor_errors; static char vendor_dev[64]; +static u32 max_nr_components; static u32 available_error_type; static u32 available_error_type_v2; @@ -178,6 +179,7 @@ static DEFINE_MUTEX(einj_mutex); bool einj_initialized __ro_after_init; static void __iomem *einj_param; +static u32 v5param_size; static void einj_exec_ctx_init(struct apei_exec_context *ctx) { @@ -302,11 +304,31 @@ static void __iomem *einj_get_parameter_address(void) struct set_error_type_with_address v5param; struct set_error_type_with_address __iomem *p; + v5param_size = sizeof(v5param); p = acpi_os_map_iomem(pa_v5, sizeof(*p)); if (p) { - memcpy_fromio(&v5param, p, sizeof(v5param)); + int offset, len; + + memcpy_fromio(&v5param, p, v5param_size); acpi5 = 1; check_vendor_extension(pa_v5, &v5param); + if (available_error_type & ACPI65_EINJV2_SUPP) { + len = v5param.einjv2_struct.length; + offset = offsetof(struct einjv2_extension_struct, component_arr); + max_nr_components = (len - offset) / + sizeof(v5param.einjv2_struct.component_arr[0]); + /* + * The first call to acpi_os_map_iomem above does not include the + * component array, instead it is used to read and calculate maximum + * number of components supported by the system. Below, the mapping + * is expanded to include the component array. + */ + acpi_os_unmap_iomem(p, v5param_size); + offset = offsetof(struct set_error_type_with_address, einjv2_struct); + v5param_size = offset + struct_size(&v5param.einjv2_struct, + component_arr, max_nr_components); + p = acpi_os_map_iomem(pa_v5, v5param_size); + } return p; } } @@ -944,7 +966,7 @@ static void __exit einj_remove(struct platform_device *pdev) if (einj_param) { acpi_size size = (acpi5) ? - sizeof(struct set_error_type_with_address) : + v5param_size : sizeof(struct einj_parameter); acpi_os_unmap_iomem(einj_param, size); -- Gitee From 9e96dc364ec25cf99cf90169365a195f9b9e9b24 Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Tue, 17 Jun 2025 12:30:24 -0700 Subject: [PATCH 10/23] ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome ANBZ: #31912 commit 90711f7bdf76faa9ed766236bc1f1fbd4364b5e7 upstream. EINJv2 allows users to inject multiple errors at the same time by specifying the device id and syndrome bits for each error in a flex array. Create files in the einj debugfs directory to enter data for each device id and syndrome value. Note that the specification says these are 128-bit little-endian values. Linux doesn't have a handy helper to manage objects of this type. Intel-SIG: commit 90711f7bdf76 ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome Backport APEI EINJ V2 support Signed-off-by: Tony Luck Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-6-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: resolve conflict and amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 97 +++++++++++++++++++++++++++++++++++ 1 file changed, 97 insertions(+) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index a2ad638440f0..03195c168bb0 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -111,6 +111,7 @@ static char vendor_dev[64]; static u32 max_nr_components; static u32 available_error_type; static u32 available_error_type_v2; +static struct syndrome_array *syndrome_data; /* * Some BIOSes allow parameters to the SET_ERROR_TYPE entries in the @@ -718,6 +719,7 @@ static u64 error_param3; static u64 error_param4; static struct dentry *einj_debug_dir; static char einj_buf[32]; +static bool einj_v2_enabled; static struct { u32 mask; const char *str; } const einj_error_type_string[] = { { BIT(0), "Processor Correctable" }, { BIT(1), "Processor Uncorrectable non-fatal" }, @@ -854,6 +856,98 @@ static int einj_check_table(struct acpi_table_einj *einj_tab) return 0; } +static ssize_t u128_read(struct file *f, char __user *buf, size_t count, loff_t *off) +{ + char output[2 * COMPONENT_LEN + 1]; + u8 *data = f->f_inode->i_private; + int i; + + if (*off >= sizeof(output)) + return 0; + + for (i = 0; i < COMPONENT_LEN; i++) + sprintf(output + 2 * i, "%.02x", data[COMPONENT_LEN - i - 1]); + output[2 * COMPONENT_LEN] = '\n'; + + return simple_read_from_buffer(buf, count, off, output, sizeof(output)); +} + +static ssize_t u128_write(struct file *f, const char __user *buf, size_t count, loff_t *off) +{ + char input[2 + 2 * COMPONENT_LEN + 2]; + u8 *save = f->f_inode->i_private; + u8 tmp[COMPONENT_LEN]; + char byte[3] = {}; + char *s, *e; + size_t c; + long val; + int i; + + /* Require that user supply whole input line in one write(2) syscall */ + if (*off) + return -EINVAL; + + c = simple_write_to_buffer(input, sizeof(input), off, buf, count); + if (c < 0) + return c; + + if (c < 1 || input[c - 1] != '\n') + return -EINVAL; + + /* Empty line means invalidate this entry */ + if (c == 1) { + memset(save, 0xff, COMPONENT_LEN); + return c; + } + + if (input[0] == '0' && (input[1] == 'x' || input[1] == 'X')) + s = input + 2; + else + s = input; + e = input + c - 1; + + for (i = 0; i < COMPONENT_LEN; i++) { + byte[1] = *--e; + byte[0] = e > s ? *--e : '0'; + if (kstrtol(byte, 16, &val)) + return -EINVAL; + tmp[i] = val; + if (e <= s) + break; + } + while (++i < COMPONENT_LEN) + tmp[i] = 0; + + memcpy(save, tmp, COMPONENT_LEN); + + return c; +} + +static const struct file_operations u128_fops = { + .read = u128_read, + .write = u128_write, +}; + +static bool setup_einjv2_component_files(void) +{ + char name[32]; + + syndrome_data = kcalloc(max_nr_components, sizeof(syndrome_data[0]), GFP_KERNEL); + if (!syndrome_data) + return false; + + for (int i = 0; i < max_nr_components; i++) { + sprintf(name, "component_id%d", i); + debugfs_create_file(name, 0600, einj_debug_dir, + &syndrome_data[i].comp_id, &u128_fops); + sprintf(name, "component_syndrome%d", i); + debugfs_create_file(name, 0600, einj_debug_dir, + &syndrome_data[i].comp_synd, &u128_fops); + } + + return true; +} + static int __init einj_probe(struct platform_device *pdev) { int rc; @@ -930,6 +1024,8 @@ static int __init einj_probe(struct platform_device *pdev) &error_param4); debugfs_create_x32("notrigger", S_IRUSR | S_IWUSR, einj_debug_dir, ¬rigger); + if (available_error_type & ACPI65_EINJV2_SUPP) + einj_v2_enabled = setup_einjv2_component_files(); } if (vendor_dev[0]) { @@ -978,6 +1074,7 @@ static void __exit einj_remove(struct platform_device *pdev) apei_resources_release(&einj_resources); apei_resources_fini(&einj_resources); debugfs_remove_recursive(einj_debug_dir); + kfree(syndrome_data); acpi_put_table((struct acpi_table_header *)einj_tab); } -- Gitee From 62707ebb94aaa5e9c59c7dbbb0d744d07752258b Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 17 Jun 2025 12:30:25 -0700 Subject: [PATCH 11/23] ACPI: APEI: EINJ: Enable EINJv2 error injections ANBZ: #31912 commit b47610296d17f90ccb24085dcd75fd083acc736d upstream. Enable injection using EINJv2 mode of operation. [Tony: Mostly Zaid's original code. I just changed how the error ID and syndrome bits are implemented. Also swapped out some camelcase variable names] Intel-SIG: commit b47610296d17 ACPI: APEI: EINJ: Enable EINJv2 error injections Backport APEI EINJ V2 support Co-developed-by: Tony Luck Signed-off-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-7-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 58 ++++++++++++++++++++++++++++------- 1 file changed, 47 insertions(+), 11 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 03195c168bb0..316af1049ef2 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -87,6 +87,7 @@ enum { SETWA_FLAGS_APICID = 1, SETWA_FLAGS_MEM = 2, SETWA_FLAGS_PCIE_SBDF = 4, + SETWA_FLAGS_EINJV2 = 8, }; /* @@ -181,6 +182,7 @@ bool einj_initialized __ro_after_init; static void __iomem *einj_param; static u32 v5param_size; +static bool is_v2; static void einj_exec_ctx_init(struct apei_exec_context *ctx) { @@ -513,12 +515,20 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, return rc; } +static bool is_end_of_list(u8 *val) +{ + for (int i = 0; i < COMPONENT_LEN; ++i) { + if (val[i] != 0xFF) + return false; + } + return true; +} static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, u64 param4) { struct apei_exec_context ctx; u64 val, trigger_paddr, timeout = FIRMWARE_TIMEOUT; - int rc; + int i, rc; einj_exec_ctx_init(&ctx); @@ -527,10 +537,10 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, return rc; apei_exec_ctx_set_input(&ctx, type); if (acpi5) { - struct set_error_type_with_address *v5param, v5_struct; + struct set_error_type_with_address *v5param; - v5param = &v5_struct; - memcpy_fromio(v5param, einj_param, sizeof(*v5param)); + v5param = kmalloc(v5param_size, GFP_KERNEL); + memcpy_fromio(v5param, einj_param, v5param_size); v5param->type = type; if (type & ACPI5_VENDOR_BIT) { switch (vendor_flags) { @@ -550,8 +560,21 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, v5param->flags = flags; v5param->memory_address = param1; v5param->memory_address_range = param2; - v5param->apicid = param3; - v5param->pcie_sbdf = param4; + + if (is_v2) { + for (i = 0; i < max_nr_components; i++) { + if (is_end_of_list(syndrome_data[i].comp_id.acpi_id)) + break; + v5param->einjv2_struct.component_arr[i].comp_id = + syndrome_data[i].comp_id; + v5param->einjv2_struct.component_arr[i].comp_synd = + syndrome_data[i].comp_synd; + } + v5param->einjv2_struct.component_arr_count = i; + } else { + v5param->apicid = param3; + v5param->pcie_sbdf = param4; + } } else { switch (type) { case ACPI_EINJ_PROCESSOR_CORRECTABLE: @@ -575,7 +598,8 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, break; } } - memcpy_toio(einj_param, v5param, sizeof(*v5param)); + memcpy_toio(einj_param, v5param, v5param_size); + kfree(v5param); } else { rc = apei_exec_run(&ctx, ACPI_EINJ_SET_ERROR_TYPE); if (rc) @@ -637,10 +661,15 @@ int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, u64 base_addr, size; /* If user manually set "flags", make sure it is legal */ - if (flags && (flags & - ~(SETWA_FLAGS_APICID|SETWA_FLAGS_MEM|SETWA_FLAGS_PCIE_SBDF))) + if (flags && (flags & ~(SETWA_FLAGS_APICID | SETWA_FLAGS_MEM | + SETWA_FLAGS_PCIE_SBDF | SETWA_FLAGS_EINJV2))) return -EINVAL; + /* check if type is a valid EINJv2 error type */ + if (is_v2) { + if (!(type & available_error_type_v2)) + return -EINVAL; + } /* * We need extra sanity checks for memory errors. * Other types leap directly to injection. @@ -749,7 +778,7 @@ static int available_error_type_show(struct seq_file *m, void *v) if (available_error_type & einj_error_type_string[pos].mask) seq_printf(m, "0x%08x\t%s\n", einj_error_type_string[pos].mask, einj_error_type_string[pos].str); - if (available_error_type & ACPI65_EINJV2_SUPP) { + if ((available_error_type & ACPI65_EINJV2_SUPP) && einj_v2_enabled) { for (int pos = 0; pos < ARRAY_SIZE(einjv2_error_type_string); pos++) { if (available_error_type_v2 & einjv2_error_type_string[pos].mask) seq_printf(m, "V2_0x%08x\t%s\n", einjv2_error_type_string[pos].mask, @@ -791,7 +820,7 @@ int einj_validate_error_type(u64 type) if (tval & (tval - 1)) return -EINVAL; if (!vendor) - if (!(type & available_error_type)) + if (!(type & (available_error_type | available_error_type_v2))) return -EINVAL; return 0; @@ -810,9 +839,11 @@ static ssize_t error_type_set(struct file *file, const char __user *buf, if (strncmp(einj_buf, "V2_", 3) == 0) { if (!sscanf(einj_buf, "V2_%llx", &val)) return -EINVAL; + is_v2 = true; } else { if (!sscanf(einj_buf, "%llx", &val)) return -EINVAL; + is_v2 = false; } rc = einj_validate_error_type(val); @@ -834,6 +865,11 @@ static int error_inject_set(void *data, u64 val) if (!error_type) return -EINVAL; + if (is_v2) + error_flags |= SETWA_FLAGS_EINJV2; + else + error_flags &= ~SETWA_FLAGS_EINJV2; + return einj_error_inject(error_type, error_flags, error_param1, error_param2, error_param3, error_param4); } -- Gitee From 68cf0cfa882a40f08ba9fa523708b61546c52bdf Mon Sep 17 00:00:00 2001 From: Zaid Alali Date: Tue, 17 Jun 2025 12:30:26 -0700 Subject: [PATCH 12/23] ACPI: APEI: EINJ: Update the documentation for EINJv2 support ANBZ: #31912 commit 8b148a97931db247771c43a0b5abdc31936c35f0 upstream. Add documentation based on implementation of EINJv2 as described in ACPI 6.5.A specification. [Tony: New user interface for device id and syndrome] Intel-SIG: commit 8b148a97931d ACPI: APEI: EINJ: Update the documentation for EINJv2 support Backport APEI EINJ V2 support Link: https://uefi.org/specs/ACPI/6.5_A/18_Platform_Error_Interfaces.html#error-injection Co-developed-by: Tony Luck Signed-off-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-8-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- .../firmware-guide/acpi/apei/einj.rst | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/Documentation/firmware-guide/acpi/apei/einj.rst b/Documentation/firmware-guide/acpi/apei/einj.rst index c52b9da08fa9..7d8435d35a18 100644 --- a/Documentation/firmware-guide/acpi/apei/einj.rst +++ b/Documentation/firmware-guide/acpi/apei/einj.rst @@ -59,6 +59,9 @@ The following files belong to it: 0x00000200 Platform Correctable 0x00000400 Platform Uncorrectable non-fatal 0x00000800 Platform Uncorrectable fatal + V2_0x00000001 EINJV2 Processor Error + V2_0x00000002 EINJV2 Memory Error + V2_0x00000004 EINJV2 PCI Express Error ================ =================================== The format of the file contents are as above, except present are only @@ -88,6 +91,8 @@ The following files belong to it: Memory address and mask valid (param1 and param2). Bit 2 PCIe (seg,bus,dev,fn) valid (see param4 below). + Bit 3 + EINJv2 extension structure is valid If set to zero, legacy behavior is mimicked where the type of injection specifies just one bit set, and param1 is multiplexed. @@ -122,6 +127,13 @@ The following files belong to it: this actually works depends on what operations the BIOS actually includes in the trigger phase. +- component_id0 .. component_idN, component_syndrome0 .. component_syndromeN + + These files are used to set the "Component Array" field + of the EINJv2 Extension Structure. Each holds a 128-bit + hex value. Writing just a newline to any of these files + sets an invalid (all-ones) value. + CXL error types are supported from ACPI 6.5 onwards (given a CXL port is present). The EINJ user interface for CXL error types is at /cxl. The following files belong to it: @@ -194,6 +206,27 @@ An error injection example:: # echo 0x8 > error_type # Choose correctable memory error # echo 1 > error_inject # Inject now +An EINJv2 error injection example:: + + # cd /sys/kernel/debug/apei/einj + # cat available_error_type # See which errors can be injected + 0x00000002 Processor Uncorrectable non-fatal + 0x00000008 Memory Correctable + 0x00000010 Memory Uncorrectable non-fatal + V2_0x00000001 EINJV2 Processor Error + V2_0x00000002 EINJV2 Memory Error + + # echo 0x12345000 > param1 # Set memory address for injection + # echo 0xfffffffffffff000 > param2 # Range - anywhere in this page + # echo 0x1 > component_id0 # First device ID + # echo 0x4 > component_syndrome0 # First error syndrome + # echo 0x2 > component_id1 # Second device ID + # echo 0x4 > component_syndrome1 # Second error syndrome + # echo '' > component_id2 # Mark id2 invalid to terminate list + # echo V2_0x2 > error_type # Choose EINJv2 memory error + # echo 0xa > flags # set flags to indicate EINJv2 + # echo 1 > error_inject # Inject now + You should see something like this in dmesg:: [22715.830801] EDAC sbridge MC3: HANDLING MCE MEMORY ERROR -- Gitee From b23748165cab165d1162a4088f9bb9ace59509eb Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 25 Jun 2025 13:57:52 -0500 Subject: [PATCH 13/23] ACPI: APEI: EINJ: prevent memory corruption in error_type_set() ANBZ: #31912 commit 80744a3bed8ce65071ca6e970a5f8b7c12213d3d upstream. The "einj_buf" buffer is 32 chars. If "count" is larger than that it results in memory corruption. Cap it at 31 so that we leave the last character as a NUL terminator. By the way, the highest reasonable value for "count" is 24. Intel-SIG: commit 80744a3bed8c ACPI: APEI: EINJ: prevent memory corruption in error_type_set() Backport APEI EINJ V2 support Fixes: 0c6176e1e186 ("ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities") Signed-off-by: Dan Carpenter Reviewed-by: Ira Weiny Link: https://patch.msgid.link/ae6286cf-4d73-4b97-8c0f-0782a65b8f51@sabinyo.mountain Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 316af1049ef2..ec3d500a60ae 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -832,6 +832,10 @@ static ssize_t error_type_set(struct file *file, const char __user *buf, int rc; u64 val; + /* Leave the last character for the NUL terminator */ + if (count > sizeof(einj_buf) - 1) + return -EINVAL; + memset(einj_buf, 0, sizeof(einj_buf)); if (copy_from_user(einj_buf, buf, count)) return -EFAULT; -- Gitee From 11614a29dfac52baa2f899c263e1bfa129026365 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Tue, 24 Jun 2025 21:10:32 +0100 Subject: [PATCH 14/23] ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable ANBZ: #31912 commit c13d38bc9b00eaab19ba4d7608677371d2d2f480 upstream. The check for c < 0 is always false because variable c is a size_t which is not a signed type. Fix this by making c a ssize_t. Intel-SIG: commit c13d38bc9b00 ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable Backport APEI EINJ V2 support Fixes: 90711f7bdf76 ("ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome") Signed-off-by: Colin Ian King Reviewed-by: Ira Weiny Link: https://patch.msgid.link/20250624201032.522168-1-colin.i.king@gmail.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index ec3d500a60ae..250bae15e435 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -919,7 +919,7 @@ static ssize_t u128_write(struct file *f, const char __user *buf, size_t count, u8 tmp[COMPONENT_LEN]; char byte[3] = {}; char *s, *e; - size_t c; + ssize_t c; long val; int i; -- Gitee From cfbc4449f1ec7a8a234c9f7e6d51ac8516bba960 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Tue, 24 Jun 2025 21:29:37 +0100 Subject: [PATCH 15/23] ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p ANBZ: #31912 commit 0fd0541b6770b190afa9534c9208c0aa774d533c upstream. In the case where a request_mem_region call fails and pointer r is null the error exit path via label 'out' will check for a non-null pointer p and try to iounmap it. However, pointer p has not been assigned a value at this point, so it may potentially contain any garbage value. Fix this by ensuring pointer p is initialized to NULL. Intel-SIG: commit 0fd0541b6770 ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p Backport APEI EINJ V2 support Fixes: 1a35c88302a3 ("ACPI: APEI: EINJ: Fix kernel test sparse warnings") Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250624202937.523013-1-colin.i.king@gmail.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 250bae15e435..ad160d6f9b50 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -402,7 +402,7 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, u32 table_size; int rc = -EIO; struct acpi_generic_address *trigger_param_region = NULL; - struct acpi_einj_trigger __iomem *p; + struct acpi_einj_trigger __iomem *p = NULL; r = request_mem_region(trigger_paddr, sizeof(trigger_tab), "APEI EINJ Trigger Table"); -- Gitee From 1030eb4ac65b1fbe482586b18cc836803ac6e2d6 Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Thu, 14 Aug 2025 09:17:06 -0700 Subject: [PATCH 16/23] ACPI: APEI: EINJ: Check if user asked for EINJV2 injection ANBZ: #31912 commit 6c705851499172c0ce863e816946fb5a564ff69f upstream. On an EINJV2 capable system, users may still use the old injection interface but einj_get_parameter_address() takes the EINJV2 path to map the parameter structure. This results in the address the user supplied being stored to the wrong location and the BIOS injecting based on an uninitialized field (0x0 in the reported case). Check the version of the request when mapping the EINJ parameter structure in BIOS reserved memory. Intel-SIG: commit 6c7058514991 ACPI: APEI: EINJ: Check if user asked for EINJV2 injection Backport APEI EINJ V2 support Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters") Reported-by: Lai, Yi1 Signed-off-by: Tony Luck Reviewed-by: Zaid Alali Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250814161706.4489-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index ad160d6f9b50..8b5893219710 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -315,7 +315,7 @@ static void __iomem *einj_get_parameter_address(void) memcpy_fromio(&v5param, p, v5param_size); acpi5 = 1; check_vendor_extension(pa_v5, &v5param); - if (available_error_type & ACPI65_EINJV2_SUPP) { + if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) { len = v5param.einjv2_struct.length; offset = offsetof(struct einjv2_extension_struct, component_arr); max_nr_components = (len - offset) / -- Gitee From 7289011c0efdf01d370aa74e5b3ec15246ef606b Mon Sep 17 00:00:00 2001 From: Charles Han Date: Fri, 15 Aug 2025 10:42:06 +0800 Subject: [PATCH 17/23] ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() ANBZ: #31912 commit 7459e87ae1d78ba27b728172fa2aa912a5b8640d upstream. The __einj_error_inject() function allocates memory via kmalloc() without checking for allocation failure, which could lead to a NULL pointer dereference. Return -ENOMEM in case allocation fails. Intel-SIG: commit 7459e87ae1d7 ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() Backport APEI EINJ V2 support Fixes: b47610296d17 ("ACPI: APEI: EINJ: Enable EINJv2 error injections") Signed-off-by: Charles Han Reviewed-by: Tony Luck Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250815024207.3038-1-hanchunchao@inspur.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 8b5893219710..d6d87ffa90f2 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -540,6 +540,9 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, struct set_error_type_with_address *v5param; v5param = kmalloc(v5param_size, GFP_KERNEL); + if (!v5param) + return -ENOMEM; + memcpy_fromio(v5param, einj_param, v5param_size); v5param->type = type; if (type & ACPI5_VENDOR_BIT) { -- Gitee From 772f2ac9c7aa64ecf927e21021267e0052d25b95 Mon Sep 17 00:00:00 2001 From: Tony Luck Date: Tue, 18 Nov 2025 17:27:12 -0800 Subject: [PATCH 18/23] ACPI: APEI: EINJ: Fix EINJV2 initialization and injection ANBZ: #31912 commit d2932a59c2d4fb364396f21df58431c44918dd47 upstream. ACPI 6.6 specification for EINJV2 appends an extra structure to the end of the existing struct set_error_type_with_address. Several issues showed up in testing. 1) Initialization was broken by an earlier fix [1] since is_v2 is only set while performing an injection, not during initialization. 2) A buggy BIOS provided invalid "revision" and "length" for the extension structure. Add several sanity checks. 3) When injecting legacy error types on an EINJV2 capable system, don't copy the component arrays. Intel-SIG: commit d2932a59c2d4 ACPI: APEI: EINJ: Fix EINJV2 initialization and injection Backport APEI EINJ V2 support Fixes: 6c7058514991 ("ACPI: APEI: EINJ: Check if user asked for EINJV2 injection") # [1] Fixes: b47610296d17 ("ACPI: APEI: EINJ: Enable EINJv2 error injections") Signed-off-by: Tony Luck [ rjw: Changelog edits ] Cc: 6.17+ # 6.17+ Link: https://patch.msgid.link/20251119012712.178715-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 64 ++++++++++++++++++++++------------- 1 file changed, 41 insertions(+), 23 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index d6d87ffa90f2..8dcf13335b78 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -182,6 +182,7 @@ bool einj_initialized __ro_after_init; static void __iomem *einj_param; static u32 v5param_size; +static u32 v66param_size; static bool is_v2; static void einj_exec_ctx_init(struct apei_exec_context *ctx) @@ -283,6 +284,24 @@ static void check_vendor_extension(u64 paddr, acpi_os_unmap_iomem(p, sizeof(v)); } +static u32 einjv2_init(struct einjv2_extension_struct *e) +{ + if (e->revision != 1) { + pr_info("Unknown v2 extension revision %u\n", e->revision); + return 0; + } + if (e->length < sizeof(*e) || e->length > PAGE_SIZE) { + pr_info(FW_BUG "Bad1 v2 extension length %u\n", e->length); + return 0; + } + if ((e->length - sizeof(*e)) % sizeof(e->component_arr[0])) { + pr_info(FW_BUG "Bad2 v2 extension length %u\n", e->length); + return 0; + } + + return (e->length - sizeof(*e)) / sizeof(e->component_arr[0]); +} + static void __iomem *einj_get_parameter_address(void) { int i; @@ -310,28 +329,21 @@ static void __iomem *einj_get_parameter_address(void) v5param_size = sizeof(v5param); p = acpi_os_map_iomem(pa_v5, sizeof(*p)); if (p) { - int offset, len; - memcpy_fromio(&v5param, p, v5param_size); acpi5 = 1; check_vendor_extension(pa_v5, &v5param); - if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) { - len = v5param.einjv2_struct.length; - offset = offsetof(struct einjv2_extension_struct, component_arr); - max_nr_components = (len - offset) / - sizeof(v5param.einjv2_struct.component_arr[0]); - /* - * The first call to acpi_os_map_iomem above does not include the - * component array, instead it is used to read and calculate maximum - * number of components supported by the system. Below, the mapping - * is expanded to include the component array. - */ + if (available_error_type & ACPI65_EINJV2_SUPP) { + struct einjv2_extension_struct *e; + + e = &v5param.einjv2_struct; + max_nr_components = einjv2_init(e); + + /* remap including einjv2_extension_struct */ acpi_os_unmap_iomem(p, v5param_size); - offset = offsetof(struct set_error_type_with_address, einjv2_struct); - v5param_size = offset + struct_size(&v5param.einjv2_struct, - component_arr, max_nr_components); - p = acpi_os_map_iomem(pa_v5, v5param_size); + v66param_size = v5param_size - sizeof(*e) + e->length; + p = acpi_os_map_iomem(pa_v5, v66param_size); } + return p; } } @@ -527,6 +539,7 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, u64 param4) { struct apei_exec_context ctx; + u32 param_size = is_v2 ? v66param_size : v5param_size; u64 val, trigger_paddr, timeout = FIRMWARE_TIMEOUT; int i, rc; @@ -539,11 +552,11 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, if (acpi5) { struct set_error_type_with_address *v5param; - v5param = kmalloc(v5param_size, GFP_KERNEL); + v5param = kmalloc(param_size, GFP_KERNEL); if (!v5param) return -ENOMEM; - memcpy_fromio(v5param, einj_param, v5param_size); + memcpy_fromio(v5param, einj_param, param_size); v5param->type = type; if (type & ACPI5_VENDOR_BIT) { switch (vendor_flags) { @@ -601,7 +614,7 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, break; } } - memcpy_toio(einj_param, v5param, v5param_size); + memcpy_toio(einj_param, v5param, param_size); kfree(v5param); } else { rc = apei_exec_run(&ctx, ACPI_EINJ_SET_ERROR_TYPE); @@ -1104,9 +1117,14 @@ static void __exit einj_remove(struct platform_device *pdev) struct apei_exec_context ctx; if (einj_param) { - acpi_size size = (acpi5) ? - v5param_size : - sizeof(struct einj_parameter); + acpi_size size; + + if (v66param_size) + size = v66param_size; + else if (acpi5) + size = v5param_size; + else + size = sizeof(struct einj_parameter); acpi_os_unmap_iomem(einj_param, size); if (vendor_errors.size) -- Gitee From 2b59dde63264e03f495903d91c430d4be3ce36da Mon Sep 17 00:00:00 2001 From: Ben Cheatham Date: Fri, 27 Sep 2024 11:34:28 -0500 Subject: [PATCH 19/23] EINJ, CXL: Fix CXL device SBDF calculation ANBZ: #31912 commit ee1e3c46ed19c096be22472c728fa7f68b1352c4 upstream. The SBDF of the target CXL 2.0 compliant root port is required to inject a CXL protocol error as per ACPI 6.5. The SBDF given has to be in the following format: 31 24 23 16 15 11 10 8 7 0 +-------------------------------------------------+ | segment | bus | device | function | reserved | +-------------------------------------------------+ The SBDF calculated in cxl_dport_get_sbdf() doesn't account for the reserved bits currently, causing the wrong SBDF to be used. Fix said calculation to properly shift the SBDF. Without this fix, error injection into CXL 2.0 root ports through the CXL debugfs interface (/cxl) is broken. Injection through the legacy interface (/apei/einj/) will still work because the SBDF is manually provided by the user. Intel-SIG: commit ee1e3c46ed19 EINJ, CXL: Fix CXL device SBDF calculation Backport APEI EINJ V2 support Fixes: 12fb28ea6b1cf ("EINJ: Add CXL error type support") Signed-off-by: Ben Cheatham Reviewed-by: Dan Williams Tested-by: Srinivasulu Thanneeru Reviewed-by: Srinivasulu Thanneeru Link: https://patch.msgid.link/20240927163428.366557-1-Benjamin.Cheatham@amd.com Signed-off-by: Ira Weiny [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-cxl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-cxl.c b/drivers/acpi/apei/einj-cxl.c index 25adc9b03d18..358700427117 100644 --- a/drivers/acpi/apei/einj-cxl.c +++ b/drivers/acpi/apei/einj-cxl.c @@ -63,7 +63,7 @@ static int cxl_dport_get_sbdf(struct pci_dev *dport_dev, u64 *sbdf) seg = bridge->domain_nr; bus = pbus->number; - *sbdf = (seg << 24) | (bus << 16) | dport_dev->devfn; + *sbdf = (seg << 24) | (bus << 16) | (dport_dev->devfn << 8); return 0; } -- Gitee From f534e8e4e7696c76c4f5f1bd9e96fe636b4d8565 Mon Sep 17 00:00:00 2001 From: Lukas Bulwahn Date: Thu, 11 Apr 2024 08:24:43 +0200 Subject: [PATCH 20/23] MAINTAINERS: repair file entry in COMPUTE EXPRESS LINK ANBZ: #31912 commit c26a55e513f7f1a2e77d6a76fc8b76d1fde9e8e1 upstream. Commit 12fb28ea6b1c ("EINJ: Add CXL error type support") adds the header file include/linux/einj-cxl.h, but then adds a file entry with cxl-einj.h (note the swapping of words) to the COMPUTE EXPRESS LINK (CXL) section. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. get_maintainer.pl can only return commit_signer history for file include/linux/einj-cxl.h because the entry in MAINTAINERS is wrong. Correct the entry so that the full MAINTAINER list is returned. Repair the file entry in COMPUTE EXPRESS LINK (CXL). Intel-SIG: commit c26a55e513f7 MAINTAINERS: repair file entry in COMPUTE EXPRESS LINK Backport APEI EINJ V2 support Signed-off-by: Lukas Bulwahn Reviewed-by: Alison Schofield Link: https://lore.kernel.org/r/20240411062443.47372-1-lukas.bulwahn@redhat.com Signed-off-by: Dave Jiang [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 0557f5b50687..35c30225616e 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5215,7 +5215,7 @@ M: Dan Williams L: linux-cxl@vger.kernel.org S: Maintained F: drivers/cxl/ -F: include/linux/cxl-einj.h +F: include/linux/einj-cxl.h F: include/linux/cxl-event.h F: include/uapi/linux/cxl_mem.h F: tools/testing/cxl/ -- Gitee From 00fd0c990ecea132c41293c44505ca1ccc81704e Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Wed, 20 Mar 2024 19:02:50 +0100 Subject: [PATCH 21/23] ACPI: APEI: EINJ: mark remove callback as non-__exit ANBZ: #31912 commit a24118a8a6870fe06dbbd59f915b9ca3662b2ddb upstream. The remove callback of a device is called whenever it is unbound, which may happen during runtime e.g. through sysfs, so this is not allowed to be dropped from the binary: WARNING: modpost: vmlinux: section mismatch in reference: einj_driver+0x8 (section: .data) -> einj_remove (section: .exit.text) ERROR: modpost: Section mismatches detected. Remove that annotation. Intel-SIG: commit a24118a8a687 ACPI: APEI: EINJ: mark remove callback as non-__exit Backport APEI EINJ V2 support Fixes: 12fb28ea6b1c ("EINJ: Add CXL error type support") Signed-off-by: Arnd Bergmann Reviewed-by: Dan Williams Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 8dcf13335b78..d47f05bbaa7d 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -1112,7 +1112,7 @@ static int __init einj_probe(struct platform_device *pdev) return rc; } -static void __exit einj_remove(struct platform_device *pdev) +static void einj_remove(struct platform_device *pdev) { struct apei_exec_context ctx; -- Gitee From e2a060bfca5b961c0692cb889f356cd4f6435fc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= Date: Fri, 29 Mar 2024 11:02:01 +0100 Subject: [PATCH 22/23] ACPI: APEI: EINJ: mark remove callback as __exit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ANBZ: #31912 commit 5a87e0020d53f21965adf42420766e4d8719a229 upstream. The einj_driver driver is registered using platform_driver_probe(). In this case it cannot get unbound via sysfs and it's ok to put the remove callback into an exit section. To prevent the modpost warning about einj_driver referencing .exit.text, mark the driver struct with __refdata and explain the situation in a comment. This is an improvement over commit a24118a8a687 ("ACPI: APEI: EINJ: mark remove callback as non-__exit") which recently addressed the same issue, but picked a less optimal variant. Intel-SIG: commit 5a87e0020d53 ACPI: APEI: EINJ: mark remove callback as __exit Backport APEI EINJ V2 support Signed-off-by: Uwe Kleine-König Reviewed-by: Dan Williams Acked-by: Arnd Bergmann Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index d47f05bbaa7d..2156371d8b86 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -1112,7 +1112,7 @@ static int __init einj_probe(struct platform_device *pdev) return rc; } -static void einj_remove(struct platform_device *pdev) +static void __exit einj_remove(struct platform_device *pdev) { struct apei_exec_context ctx; @@ -1140,8 +1140,14 @@ static void einj_remove(struct platform_device *pdev) } static struct platform_device *einj_dev; -static struct platform_driver einj_driver = { - .remove_new = einj_remove, +/* + * einj_remove() lives in .exit.text. For drivers registered via + * platform_driver_probe() this is ok because they cannot get unbound at + * runtime. So mark the driver struct with __refdata to prevent modpost + * triggering a section mismatch warning. + */ +static struct platform_driver einj_driver __refdata = { + .remove_new = __exit_p(einj_remove), .driver = { .name = "acpi-einj", }, -- Gitee From 161b9024202848adeb04570b5df1a93904192d58 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Tue, 21 May 2024 15:46:32 -0700 Subject: [PATCH 23/23] ACPI: APEI: EINJ: Fix einj_dev release leak ANBZ: #31912 commit 7ff6c798eca05e4a9dcb80163cb454d7787a4bc3 upstream. The platform driver conversion of EINJ mistakenly used platform_device_del() to unwind platform_device_register_full() at module exit. This leads to a small leak of one 'struct platform_device' instance per module load/unload cycle. Switch to platform_device_unregister() which performs both device_del() and final put_device(). Intel-SIG: commit 7ff6c798eca0 ACPI: APEI: EINJ: Fix einj_dev release leak Backport APEI EINJ V2 support Fixes: 5621fafaac00 ("EINJ: Migrate to a platform driver") Cc: 6.9+ # 6.9+ Signed-off-by: Dan Williams Reviewed-by: Ben Cheatham Signed-off-by: Rafael J. Wysocki [ Zhang Rui: amend commit log ] Signed-off-by: Zhang Rui --- drivers/acpi/apei/einj-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/apei/einj-core.c b/drivers/acpi/apei/einj-core.c index 2156371d8b86..0a14270fdcff 100644 --- a/drivers/acpi/apei/einj-core.c +++ b/drivers/acpi/apei/einj-core.c @@ -1176,7 +1176,7 @@ static void __exit einj_exit(void) if (einj_initialized) platform_driver_unregister(&einj_driver); - platform_device_del(einj_dev); + platform_device_unregister(einj_dev); } module_init(einj_init); -- Gitee