[PATCH 0/3] ACPI: Work around Samsung Galaxy Book 930XDB firmware errors

[PATCH 0/3] ACPI: Work around Samsung Galaxy Book 930XDB firmware errors

[Leonard Lausen]

This series addresses two firmware errors on my Samsung Galaxy Book
930XDB (NP930XDB-KF2US): repeated FAN0._FST errors when the fan is running,
and a wrong namespace lookup in PEG0._STA.

The tested system identifies itself as:
  System vendor: SAMSUNG ELECTRONICS CO., LTD.
  Product name: 930XDB/931XDB/930XDY
  BIOS version: P11RFX.067.230331.SP (03/31/2023)

Patch 1 ports Ivan Hu's already accepted ACPICA parser fix [1]. This is a
prerequisite for patch 3, which uses acpi_install_method() to replace
PEG0._STA before namespace initialization evaluates it. Patch 2 skips the
broken fan status method and its notification handling while preserving
legacy fan control. Both firmware quirks match the vendor and full DMI
product string.

Testing on this machine includes a successful Linux 7.3 (7.3.0+) boot
with both quirks enabled. I have also been running the original versions
of these fixes during general laptop use, including suspend/resume, and
fan behavior has been fine.

Additional validation during preparation:
  - All five changed C files build on x86_64 with W=1.
  - All patches pass scripts/checkpatch.pl --strict.
  - acpiexec fixtures reproduce the original PEG0 lookup error and verify
    that the replacement returns 0 or 0x0f according to the root PG0E field.
  - A fixture of FAN0._FST reproduces the reference/Add error at nonzero
    speed and confirms that the zero-speed path can succeed.

A separate platform/x86 patch accepts notification 0x71 in the Samsung
Galaxy Book driver. It has no dependency on this ACPI series.

[1] https://github.com/open-acpica/acpica/commit/19429ef91ebfb2144c918038dce13e297b4ef051

Ivan Hu (1):
  ACPICA: Initialize ParserState.AmlEnd in AcpiInstallMethod

Leonard Lausen (2):
  ACPI: fan: Ignore broken _FST on Samsung Galaxy Book 930XDB
  ACPI: x86: Repair broken PEG0._STA on Samsung Galaxy Book 930XDB

 drivers/acpi/acpica/nsxfname.c |  1 +
 drivers/acpi/bus.c             |  2 ++
 drivers/acpi/fan_core.c        | 31 +++++++++++++++++---
 drivers/acpi/x86/utils.c       | 53 ++++++++++++++++++++++++++++++++++
 include/acpi/acpi_bus.h        |  2 ++
 5 files changed, 85 insertions(+), 4 deletions(-)


base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.55.0

[PATCH 1/3] ACPICA: Initialize ParserState.AmlEnd in AcpiInstallMethod

[Leonard Lausen]

From: Ivan Hu <ivan.hu@canonical.com>

In AcpiInstallMethod(), the local ParserState is stack-allocated and
only ParserState.Aml was initialized. Parser helpers called by this path
read ParserState.AmlEnd for bounds checking: AcpiPsPeekOpcode() reads it
before validating the first AML opcode, and AcpiPsGetNextPackageEnd()
reads it indirectly via AcpiPsGetNextPackageLength(). The subsequent
package-limit check also compares against ParserState.AmlEnd. Because
AmlEnd was never set, these checks operated on an uninitialized value,
which Coverity flagged as an uninitialized read (CID 1684785) and which
could lead to incorrect parser bounds decisions.

Coverity report:

*** CID 1684785:         Memory - illegal accesses  (UNINIT)
/src/acpica/source/components/namespace/nsxfname.c: 712             in AcpiInstallMethod()
        ParserState.Aml += AcpiPsGetOpcodeSize (Opcode);
>>>     CID 1684785:         Memory - illegal accesses  (UNINIT)
>>>     Using uninitialized value "ParserState.AmlEnd" when calling
        "AcpiPsGetNextPackageEnd".
        ParserState.PkgEnd = AcpiPsGetNextPackageEnd (&ParserState);

Initialize ParserState.AmlEnd to the end of the table
(Buffer + Table->Length) so the parser bounds checks operate on a valid
limit.

Link: https://github.com/open-acpica/acpica/commit/19429ef91ebfb2144c918038dce13e297b4ef051
Fixes: bdc357540129 ("ACPICA: add boundary checks in two places")
Signed-off-by: Ivan Hu <ivan.hu@canonical.com>
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Signed-off-by: Leonard Lausen <leonard@lausen.nl>
---
 drivers/acpi/acpica/nsxfname.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index b6534187cd43..fcd94947fedb 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -503,6 +503,7 @@ acpi_status acpi_install_method(u8 *buffer)
 	/* First AML opcode in the table must be a control method */
 
 	parser_state.aml = buffer + sizeof(struct acpi_table_header);
+	parser_state.aml_end = buffer + table->length;
 	opcode = acpi_ps_peek_opcode(&parser_state);
 	if (opcode != AML_METHOD_OP) {
 		return (AE_BAD_PARAMETER);
-- 
2.55.0

Re: [PATCH 1/3] ACPICA: Initialize ParserState.AmlEnd in AcpiInstallMethod

[Rafael J. Wysocki (Intel)]

On Mon, Oct 19, 2026 at 4:54 PM Leonard Lausen <leonard@lausen.nl> wrote:
>
> From: Ivan Hu <ivan.hu@canonical.com>
>
> In AcpiInstallMethod(), the local ParserState is stack-allocated and
> only ParserState.Aml was initialized. Parser helpers called by this path
> read ParserState.AmlEnd for bounds checking: AcpiPsPeekOpcode() reads it
> before validating the first AML opcode, and AcpiPsGetNextPackageEnd()
> reads it indirectly via AcpiPsGetNextPackageLength(). The subsequent
> package-limit check also compares against ParserState.AmlEnd. Because
> AmlEnd was never set, these checks operated on an uninitialized value,
> which Coverity flagged as an uninitialized read (CID 1684785) and which
> could lead to incorrect parser bounds decisions.
>
> Coverity report:
>
> *** CID 1684785:         Memory - illegal accesses  (UNINIT)
> /src/acpica/source/components/namespace/nsxfname.c: 712             in AcpiInstallMethod()
>         ParserState.Aml += AcpiPsGetOpcodeSize (Opcode);
> >>>     CID 1684785:         Memory - illegal accesses  (UNINIT)
> >>>     Using uninitialized value "ParserState.AmlEnd" when calling
>         "AcpiPsGetNextPackageEnd".
>         ParserState.PkgEnd = AcpiPsGetNextPackageEnd (&ParserState);
>
> Initialize ParserState.AmlEnd to the end of the table
> (Buffer + Table->Length) so the parser bounds checks operate on a valid
> limit.
>
> Link: https://github.com/open-acpica/acpica/commit/19429ef91ebfb2144c918038dce13e297b4ef051
> Fixes: bdc357540129 ("ACPICA: add boundary checks in two places")
> Signed-off-by: Ivan Hu <ivan.hu@canonical.com>
> Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
> Signed-off-by: Leonard Lausen <leonard@lausen.nl>
> ---
>  drivers/acpi/acpica/nsxfname.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
> index b6534187cd43..fcd94947fedb 100644
> --- a/drivers/acpi/acpica/nsxfname.c
> +++ b/drivers/acpi/acpica/nsxfname.c
> @@ -503,6 +503,7 @@ acpi_status acpi_install_method(u8 *buffer)
>         /* First AML opcode in the table must be a control method */
>
>         parser_state.aml = buffer + sizeof(struct acpi_table_header);
> +       parser_state.aml_end = buffer + table->length;
>         opcode = acpi_ps_peek_opcode(&parser_state);
>         if (opcode != AML_METHOD_OP) {
>                 return (AE_BAD_PARAMETER);
> --

Applied as 7.4-rc material, thanks!

[PATCH 2/3] ACPI: fan: Ignore broken _FST on Samsung Galaxy Book 930XDB

[Leonard Lausen]

FAN0._FST on the Samsung Galaxy Book 930XDB stores the reference
returned by Index() in a local variable and passes that reference to
Add(). ACPICA rejects the operand with AE_AML_OPERAND_TYPE when the fan
is running. The zero-speed path does not execute the faulty Add() and
can succeed.

The Microsoft fan extensions added a notification handler that evaluates
_FST on each fan status change. On this machine, fan notifications now
produce repeated ACPI errors, particularly around s2idle suspend/resume.
Speed telemetry also fails whenever the faulty path is taken.

Ignore _FST on this model. This skips the unusable speed telemetry and
Microsoft notification handling while preserving the legacy firmware fan
control. Match the vendor and full DMI product string,
930XDB/931XDB/930XDY. The firmware was inspected on BIOS
P11RFX.067.230331.SP.

Fixes: a5c2fcd82e04 ("ACPI: fan: Add support for Microsoft fan extensions")
Signed-off-by: Leonard Lausen <leonard@lausen.nl>
---
 drivers/acpi/fan_core.c | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/fan_core.c b/drivers/acpi/fan_core.c
index 624d0736b581..48a6818e6282 100644
--- a/drivers/acpi/fan_core.c
+++ b/drivers/acpi/fan_core.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/bits.h>
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/limits.h>
 #include <linux/math.h>
@@ -50,6 +51,24 @@ static const struct acpi_device_id fan_device_ids[] = {
 };
 MODULE_DEVICE_TABLE(acpi, fan_device_ids);
 
+/*
+ * The _FST method on these machines stores an Index() reference in a local
+ * variable and then uses that reference as an Add() operand when the fan is
+ * running.  This aborts the method with AE_AML_OPERAND_TYPE.  The Microsoft
+ * fan extensions install a notification handler that evaluates this broken
+ * method on each fan status change, producing repeated ACPI errors.
+ */
+static const struct dmi_system_id acpi_fan_broken_fst_dmi_table[] = {
+	{
+		.ident = "Samsung Galaxy Book 930XDB/931XDB/930XDY",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "930XDB/931XDB/930XDY"),
+		},
+	},
+	{}
+};
+
 /* thermal cooling device callbacks */
 static int fan_get_max_state(struct thermal_cooling_device *cdev, unsigned long
 			     *state)
@@ -511,10 +530,14 @@ static int acpi_fan_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, fan);
 
 	if (acpi_has_method(device->handle, "_FST")) {
-		fan->has_fst = true;
-		fan->acpi4 = acpi_has_method(device->handle, "_FIF") &&
-				acpi_has_method(device->handle, "_FPS") &&
-				acpi_has_method(device->handle, "_FSL");
+		if (dmi_check_system(acpi_fan_broken_fst_dmi_table)) {
+			dev_warn(&pdev->dev, FW_BUG "Ignoring broken _FST method\n");
+		} else {
+			fan->has_fst = true;
+			fan->acpi4 = acpi_has_method(device->handle, "_FIF") &&
+					acpi_has_method(device->handle, "_FPS") &&
+					acpi_has_method(device->handle, "_FSL");
+		}
 	}
 
 	if (fan->acpi4) {
-- 
2.55.0

Re: [PATCH 2/3] ACPI: fan: Ignore broken _FST on Samsung Galaxy Book 930XDB

[Armin Wolf]

Am 19.10.26 um 16:54 schrieb Leonard Lausen:
> FAN0._FST on the Samsung Galaxy Book 930XDB stores the reference
> returned by Index() in a local variable and passes that reference to
> Add(). ACPICA rejects the operand with AE_AML_OPERAND_TYPE when the fan
> is running. The zero-speed path does not execute the faulty Add() and
> can succeed.

This is very likely connected to 
https://github.com/open-acpica/acpica/issues/908. The ACPI spec says 
that Increment/Decrement is "Equivalent to Add (Addend, 1, Addend)", so 
i suspect that Add() should try to automatically dereference the reference.

I would suggest that you report this issue to the ACPICA guys instead.

Thanks,
Armin Wolf

> The Microsoft fan extensions added a notification handler that evaluates
> _FST on each fan status change. On this machine, fan notifications now
> produce repeated ACPI errors, particularly around s2idle suspend/resume.
> Speed telemetry also fails whenever the faulty path is taken.
> 
> Ignore _FST on this model. This skips the unusable speed telemetry and
> Microsoft notification handling while preserving the legacy firmware fan
> control. Match the vendor and full DMI product string,
> 930XDB/931XDB/930XDY. The firmware was inspected on BIOS
> P11RFX.067.230331.SP.
> 
> Fixes: a5c2fcd82e04 ("ACPI: fan: Add support for Microsoft fan extensions")
> Signed-off-by: Leonard Lausen <leonard@lausen.nl>
> ---
>   drivers/acpi/fan_core.c | 31 +++++++++++++++++++++++++++----
>   1 file changed, 27 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/acpi/fan_core.c b/drivers/acpi/fan_core.c
> index 624d0736b581..48a6818e6282 100644
> --- a/drivers/acpi/fan_core.c
> +++ b/drivers/acpi/fan_core.c
> @@ -8,6 +8,7 @@
>    */
>   
>   #include <linux/bits.h>
> +#include <linux/dmi.h>
>   #include <linux/kernel.h>
>   #include <linux/limits.h>
>   #include <linux/math.h>
> @@ -50,6 +51,24 @@ static const struct acpi_device_id fan_device_ids[] = {
>   };
>   MODULE_DEVICE_TABLE(acpi, fan_device_ids);
>   
> +/*
> + * The _FST method on these machines stores an Index() reference in a local
> + * variable and then uses that reference as an Add() operand when the fan is
> + * running.  This aborts the method with AE_AML_OPERAND_TYPE.  The Microsoft
> + * fan extensions install a notification handler that evaluates this broken
> + * method on each fan status change, producing repeated ACPI errors.
> + */
> +static const struct dmi_system_id acpi_fan_broken_fst_dmi_table[] = {
> +	{
> +		.ident = "Samsung Galaxy Book 930XDB/931XDB/930XDY",
> +		.matches = {
> +			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
> +			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "930XDB/931XDB/930XDY"),
> +		},
> +	},
> +	{}
> +};
> +
>   /* thermal cooling device callbacks */
>   static int fan_get_max_state(struct thermal_cooling_device *cdev, unsigned long
>   			     *state)
> @@ -511,10 +530,14 @@ static int acpi_fan_probe(struct platform_device *pdev)
>   	platform_set_drvdata(pdev, fan);
>   
>   	if (acpi_has_method(device->handle, "_FST")) {
> -		fan->has_fst = true;
> -		fan->acpi4 = acpi_has_method(device->handle, "_FIF") &&
> -				acpi_has_method(device->handle, "_FPS") &&
> -				acpi_has_method(device->handle, "_FSL");
> +		if (dmi_check_system(acpi_fan_broken_fst_dmi_table)) {
> +			dev_warn(&pdev->dev, FW_BUG "Ignoring broken _FST method\n");
> +		} else {
> +			fan->has_fst = true;
> +			fan->acpi4 = acpi_has_method(device->handle, "_FIF") &&
> +					acpi_has_method(device->handle, "_FPS") &&
> +					acpi_has_method(device->handle, "_FSL");
> +		}
>   	}
>   
>   	if (fan->acpi4) {

[PATCH 3/3] ACPI: x86: Repair broken PEG0._STA on Samsung Galaxy Book 930XDB

[Leonard Lausen]

The SaSsdt table on the Samsung Galaxy Book 930XDB with BIOS
P11RFX.067.230331.SP declares PG0E as an external object at the namespace
root. PEG0._STA nevertheless encodes PG0E as an unqualified NameSeg.

Namespace lookup from PEG0 finds the unrelated empty Package at
\_SB.PC00.PG0E before the intended integer field at \PG0E. Comparing
that Package with One aborts _STA with AE_AML_OPERAND_TYPE.

A regular acpi_device status override is too late to prevent this.
ACPICA evaluates _STA while initializing namespace objects, before
struct acpi_device exists, and acpi_get_devices() evaluates it again
without going through acpi_bus_get_status().

Replace only PEG0._STA after the tables have been loaded and before ACPI
objects are initialized. The replacement retains the firmware logic but
uses an absolute path for \PG0E, so every _STA evaluation follows the
intended namespace object. Match the vendor and full DMI product string,
930XDB/931XDB/930XDY.

Signed-off-by: Leonard Lausen <leonard@lausen.nl>
---
 drivers/acpi/bus.c       |  2 ++
 drivers/acpi/x86/utils.c | 53 ++++++++++++++++++++++++++++++++++++++++
 include/acpi/acpi_bus.h  |  2 ++
 3 files changed, 57 insertions(+)

diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 808c6746be14..555270fb49dd 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1376,6 +1376,8 @@ static int __init acpi_bus_init(void)
 		goto error1;
 	}
 
+	acpi_quirk_override_broken_methods();
+
 	/*
 	 * ACPI 2.0 requires the EC driver to be loaded and work before the EC
 	 * device is found in the namespace.
diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
index 418951639f51..661267a5f8ba 100644
--- a/drivers/acpi/x86/utils.c
+++ b/drivers/acpi/x86/utils.c
@@ -67,6 +67,59 @@ struct override_status_id {
 #define NOT_PRESENT_ENTRY_PATH(path, cpu_vfm, dmi...) \
 	ENTRY(0, "", NULL, path, cpu_vfm, dmi)
 
+/*
+ * The firmware method is equivalent to this ASL, except that it references
+ * PG0E without the root prefix and resolves to an unrelated Package object:
+ *
+ * Method (\_SB.PC00.PEG0._STA, 0, NotSerialized)
+ * {
+ *     If ((\PG0E == One))
+ *         Return (0x0F)
+ *
+ *     Return (Zero)
+ * }
+ *
+ * acpi_install_method() requires a complete table containing one method.  The
+ * AML below was generated from the ASL above with iasl 20250404.
+ */
+static u8 samsung_930xdb_peg0_sta[] __initdata = {
+	0x53, 0x53, 0x44, 0x54, 0x48, 0x00, 0x00, 0x00,
+	0x02, 0xc8, 0x4c, 0x49, 0x4e, 0x55, 0x58, 0x20,
+	0x50, 0x45, 0x47, 0x30, 0x53, 0x54, 0x41, 0x20,
+	0x01, 0x00, 0x00, 0x00, 0x49, 0x4e, 0x54, 0x4c,
+	0x04, 0x04, 0x25, 0x20, 0x14, 0x23, 0x5c, 0x2f,
+	0x04, 0x5f, 0x53, 0x42, 0x5f, 0x50, 0x43, 0x30,
+	0x30, 0x50, 0x45, 0x47, 0x30, 0x5f, 0x53, 0x54,
+	0x41, 0x00, 0xa0, 0x0b, 0x93, 0x5c, 0x50, 0x47,
+	0x30, 0x45, 0x01, 0xa4, 0x0a, 0x0f, 0xa4, 0x00,
+};
+
+static const struct dmi_system_id acpi_method_override_dmi_ids[] __initconst = {
+	{
+		.ident = "Samsung Galaxy Book 930XDB/931XDB/930XDY",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "930XDB/931XDB/930XDY"),
+		},
+	},
+	{}
+};
+
+void __init acpi_quirk_override_broken_methods(void)
+{
+	acpi_status status;
+
+	if (!dmi_check_system(acpi_method_override_dmi_ids))
+		return;
+
+	status = acpi_install_method(samsung_930xdb_peg0_sta);
+	if (ACPI_FAILURE(status))
+		pr_warn(FW_BUG "Failed to replace broken PEG0._STA: %s\n",
+			acpi_format_exception(status));
+	else
+		pr_info(FW_BUG "Replaced broken PEG0._STA method\n");
+}
+
 static const struct override_status_id override_status_ids[] = {
 	/*
 	 * Bay / Cherry Trail PWM directly poked by GPU driver in win10,
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index a10a591c18b2..ebdd197dbbc4 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -713,10 +713,12 @@ int acpi_enable_wakeup_device_power(struct acpi_device *dev, int state);
 int acpi_disable_wakeup_device_power(struct acpi_device *dev);
 
 #ifdef CONFIG_X86
+void acpi_quirk_override_broken_methods(void);
 bool acpi_device_override_status(struct acpi_device *adev, unsigned long long *status);
 bool acpi_quirk_skip_acpi_ac_and_battery(void);
 int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip);
 #else
+static inline void acpi_quirk_override_broken_methods(void) { }
 static inline bool acpi_device_override_status(struct acpi_device *adev,
 					       unsigned long long *status)
 {
-- 
2.55.0