summaryrefslogtreecommitdiff
path: root/drivers/platform/x86
AgeCommit message (Collapse)Author
2 hoursMerge branch 'for-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git
2 hoursMerge branch 'master' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
3 hoursMerge branch 'next' of git://linuxtv.org/media-ci/media-pending.gitMark Brown
4 hoursMerge branch 'fixes' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git
7 hoursMerge branch into tip/master: 'perf/merge'Ingo Molnar
# New commits in perf/merge: 3eaa50e1e255 ("x86/cpu: Hide and rename static_cpu_has()") edda9051e267 ("perf/x86/amd/uncore: Add group validation") d7ebbae57de3 ("selftests/bpf: Add tests for forked/cloned optimized uprobes") eccf368562bb ("selftests/bpf: Add tests for uprobe nop10 red zone clobbering") 28d57db3e8d4 ("selftests/bpf: Add reattach tests for uprobe syscall") b2cf7c41e4f1 ("selftests/bpf: Change uprobe/usdt trigger bench code to use nop10") ec0596a02083 ("selftests/bpf: Change uprobe syscall tests to use nop10") 6d91200bcbb5 ("selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch") 8cae54c58608 ("libbpf: Detect uprobe syscall with new error") ee2862439e5c ("libbpf: Change has_nop_combo to work on top of nop10") 554ba38456da ("uprobes/x86: Move optimized uprobe from nop5 to nop10") d9a48e77f6fe ("uprobes/x86: Allow to copy uprobe trampolines on fork") 07c308eb2bcf ("uprobes/x86: Do not leak trampoline vma mapping on optimization failure") 38af0dd6a266 ("uprobes/x86: Remove struct uprobe_trampoline object") a4573a3838ae ("perf/core: Check kernel access when kernel callchains are requested") 166f10836a65 ("perf/core: Fix kernel register info leak via hardware skid") a6b5fbc33172 ("perf/x86/intel: Drop fixed-counter PEBS constraints for baseline PEBS") 01c153956b44 ("perf/x86/intel: Validate the return value of intel_pmu_init_hybrid()") e2b0575900ff ("perf/x86/intel: Fix kernel address leakages in LBR stack") 170cc6b02e3d ("perf/x86/intel: Fallback to sw branch type decoding if no hw decoding") 3c4ec9b2a5db ("perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable state") 8767b4d73018 ("perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities") b25813b17944 ("perf/x86/intel/uncore: Implement lazy setup for MSR/MMIO PMUs") 174f0582e38a ("perf/x86/intel/uncore: Fix uncore_box ref/unref ordering") 30c0a1095652 ("perf/x86/intel/uncore: Introduce PMU flags and broken state") ae7ca8796dda ("perf/x86/intel/uncore: Factor out box setup code") 3012af7df343 ("perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails") cbbc25209ce3 ("perf/x86/intel/uncore: Let init_box() callback report failures") 7d3a9ff98898 ("perf/x86/intel/uncore: Fix refcnt and other cleanups") 003267cb94e2 ("perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure") Signed-off-by: Ingo Molnar <mingo@kernel.org>
10 daysplatform/x86: asus-wmi: temporarily revert to setting a charge limitDenis Benato
A userspace regression has been observed leaving the battery charging threshold unconfigured, so while the fix is being shipped revert the change keeping the infrastructure in place to return to the preferred behaviour as soon as it's appropriate to do. Link: https://lore.kernel.org/all/5db117b7-aad1-437f-a3d4-ba7b29fc68b3@redhat.com/ Link: https://gitlab.freedesktop.org/upower/upower/-/work_items/347 Closes: https://lore.kernel.org/all/CABsFS_g+V_Owum6knLhenhM15EXJRrsF0FcLiw30WZxarsTpUA@mail.gmail.com/ Fixes: 186bf9031666 ("platform/x86: asus-wmi: do not enforce a battery charge threshold") Reported-by: Travers Biddle <traversbiddle@gmail.com> Signed-off-by: Denis Benato <denis.benato@linux.dev> Link: https://patch.msgid.link/20260710165841.59957-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/intel/vsec: free ACPI discovery data on early errorsYousef Alhouseen
intel_vsec_add_dev() may attach an ACPI discovery table copy to the intel_vsec_device before passing ownership to intel_vsec_add_aux(). The normal auxiliary-device release path frees that copy, but the earliest intel_vsec_add_aux() failures free only the outer structure directly. Route those direct frees through a common helper so acpi_disc is released consistently on the parent, xarray, and ID allocation failure paths. Fixes: 22fa2ebc11a1 ("platform/x86/intel/vsec: Plumb ACPI PMT discovery tables through vsec") Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: David E. Box <david.e.box@linux.intel.com> Link: https://patch.msgid.link/CAMuQ4bUtJtYNTguKoiXngROJw0QQQcrvW3=3_B0-hpMQOFqvCQ@mail.gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysMerge tag 'platform-drivers-x86-v7.2-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - amd/pmc: - Use correct IP block table for AMD 1Ah M80H SoC - Avoid logging "(null)" for missing DMI values - asus-armoury: update power limits for G614PR - bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume * tag 'platform-drivers-x86-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC platform/x86: asus-armoury: update power limits for G614PR platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
10 daysplatform/x86: asus-wmi: fix resource leaks on probe failureMarco Scardovi
During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence. Specifically: 1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to fail_custom_fan_curve. Because this label is placed below fail_sysfs, it bypasses the cleanup calls for the input device and sysfs groups, which were successfully registered before, leaking those resources. 2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad. Because fail_screenpad is placed below fail_backlight, it bypasses the cleanup calls for backlight and rfkill, leaking those resources. Fix these resource leaks by reordering the error path labels in asus_wmi_add() to match the exact reverse order of the resource allocations. Fixes: 0f0ac158d28f ("platform/x86: asus-wmi: Add support for custom fan curves") Fixes: 2c97d3e55b70 ("platform/x86: asus-wmi: add support for ASUS screenpad") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi <scardracs@disroot.org> Link: https://patch.msgid.link/20260617155104.10111-1-scardracs@disroot.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/amd/pmf: Implement util layer ioctl handlerShyam Sundar S K
Implement the ioctl handler for the util layer character device. This support adds the actual functionality to populate PMF metrics from the TA shared memory buffer and return them to userspace. The implementation includes: - amd_pmf_populate_data() to extract metrics from TA shared memory - amd_pmf_set_ioctl() to handle userspace ioctl requests - Size negotiation for forward/backward compatibility - Feature-based population of struct fields - Export amd_pmf_get_ta_custom_bios_inputs() Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609081044.2416731-6-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/amd/pmf: Move debug helper functions to UAPI headerShyam Sundar S K
These debug helper functions convert enumerated values to appropriate message and can be useful for userspace tools and other kernel components that need to interpret AMD PMF state values. By making them inline functions in the UAPI header, they become available to both kernel and userspace without code duplication. Also, prefix the function names with amd_pmf_. Also, include a case to cover unused enum entries. Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609081044.2416731-5-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/amd/pmf: Store commonly used enums in the header fileShyam Sundar S K
Relocate commonly used enums from multiple source files into a shared header file to simplify code structure, improve readability, and enhance maintainability. Also, remove the initialization of the first enum member, since it is not needed. Add the AMD_PMF_ prefix to the laptop_placement and platform_type enums since these names are overly generic for inclusion in a UAPI header Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609081044.2416731-4-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/amd/pmf: store BIOS output values for user-space metrics via ↵Shyam Sundar S K
util IOCTL Add a bios_output[] to amd_pmf_dev struct and store the latest values for BIOS output policies when applying PMF policies. This enables the AMD PMF util layer to expose these BIOS outputs alongside selected thermal and power metrics to user space via /dev/amdpmf_interface and a new IOCTL, supporting real-time monitoring tools such as SystemDeck. Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609081044.2416731-3-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/amd/pmf: Add util layer and userspace character device interfaceShyam Sundar S K
Add a util layer to AMD PMF that exposes a minimal userspace interface via a character device for metrics monitoring and feature discovery. This creates /dev/amdpmf_interface with basic ioctl support to retrieve PMF metrics such as: * Power source and power slider position * Platform type, lid state, and user presence * Skin temperature and ambient light * BIOS input parameters (1-10) * Graphics workload metrics * CPU C-state residency (average and maximum) * Socket power consumption * Auto Mode: Automatic power profile switching based on system activity * Static Power Slider: User-selectable power profiles * Policy Builder (Smart PC): Action based policy management * Dynamic Power Slider AC: Adaptive power profiles when on AC power * Dynamic Power Slider DC: Adaptive power profiles when on battery The interface enables smoother integration with userspace tools such as AMD SystemDeck [1], which is widely used for monitoring and controlling power and thermal behavior on AMD platforms. These tools help designers keep major components within thermal limits to ensure proper operation and enhance overall system stability and reliability. The feature is gated behind the CONFIG_AMD_PMF_UTIL_SUPPORT Kconfig option, allowing it to be disabled if not needed. The implementation uses existing PMF infrastructure to populate data from the TA (Trusted Application) shared memory buffer. Link: https://docs.amd.com/v/u/en-US/68773_0.50 [1] Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609081044.2416731-2-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86: asus-wireless: Fail probe when there is no ACPI matchLinmao Li
Every platform driver can be forced to match a device that does not match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device ACPI companion object need to verify its presence. asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match, leaving behind an input device that never reports anything because the notify handler is not installed. Worse, when the driver is force-bound to a device without an ACPI companion, probe still succeeds and stores a NULL companion pointer, which asus_wireless_remove() later passes to acpi_dev_remove_notify_handler(), leading to a NULL pointer dereference on unbind. Return -ENODEV when the device does not match the ID table. This also covers the missing-companion case, because acpi_match_acpi_device() rejects a NULL device. Perform the check before allocating any driver state, instead of after the input device has already been registered. Fixes: f7e648027d7e ("platform/x86: asus-wireless: Convert ACPI driver to a platform one") Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260710094355.186143-1-lilinmao@kylinos.cn Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86/amd: Introduce Halo Box RGB LED driverYo-Jung Leo Lin (AMD)
The Halo Box features an RGB LED light bar that can be controlled through WMI methods to display any color combination. The driver exposes the LED through the LED multicolor subsystem, allowing userspace to control RGB values via sysfs: /sys/class/leds/amd_halo:multicolor:status/multi_intensity /sys/class/leds/amd_halo:multicolor:status/brightness Hardware interface: - Three separate RGB channels (Red, Green, Blue) - All 3 channels are configured at once with a single WMI method call - Value range: 0-100 (matching hardware range directly) Co-developed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org> Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Yo-Jung Leo Lin (AMD) <Leo.Lin@amd.com> Link: https://patch.msgid.link/20260709-halo-leds-v2-plus-v8-1-b34c64277193@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86: hp-bioscfg: warn on element type mismatch instead of failingMuhammad Bilal
hp_populate_enumeration_elements_from_package() returns -EIO and aborts enumeration of the entire attribute when any single element has an unexpected ACPI type. This is observed on HP EliteBook 840 G2 when the BIOS returns malformed ACPI data following a failed WMI query: ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Index (0x000000032) is beyond end of object (length 0x32) ACPI Error: Aborting method \_SB.WMID.WQBE due to previous error Error expected type 2 for elem 13, but got type 1 instead hp_bioscfg: Returned error 0x3, "Invalid command value/Feature not supported" Aborting immediately discards the attribute entirely. Warn about the unexpected element type, free the temporary string, skip the offending element, and continue parsing the remaining package instead of failing the whole attribute. Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260709165900.30615-5-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOSMuhammad Bilal
hp_init_bios_package_attribute() hard-fails when a WMI ACPI package contains fewer elements than the type-specific expected count (e.g. 11 elements instead of 13 for INTEGER or ENUMERATION attributes). This causes the entire hp_bioscfg driver to skip attribute enumeration on older HP hardware whose BIOS returns shortened packages when optional fields like prerequisites or possible values are absent. Observed on HP EliteBook 840 G2 (BIOS M71 Ver. 01.31): hp_bioscfg: ACPI-package does not have enough elements: 11 < 13 The element layout has two tiers: - Elements 0-9 (SECURITY_LEVEL+1 = 10): common to all attribute types - Elements 10-N: type-specific (bounds, values, encodings, ...) The per-type populate functions (hp_populate_*_elements_from_package) already handle sparse packages correctly via their own elem < count loop guards and inner-loop bounds checks. The only unsafe case is when we lack even the common elements needed to register the attribute. Fix by introducing COMMON_ELEM_CNT to mark the hard minimum (10), and splitting the check into two tiers: - Fewer than COMMON_ELEM_CNT elements: hard fail, can't proceed. - Fewer than expected type-specific elements: warn, but let the populate function parse what is available. Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260709165900.30615-4-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86: hp-bioscfg: bound ordered-list parsing by the package countMuhammad Bilal
hp_populate_ordered_list_elements_from_package() differs from the other per-type parsers: its main loop is bounded only by the fixed per-type count and never checks elem against the number of elements actually present in the package, for (elem = 1, eloc = 1; eloc < ORD_ELEM_CNT; elem++, eloc++) whereas the string, integer, enumeration and password parsers bound their main loop with "elem < count" as well. This is safe today because hp_init_bios_package_attribute() rejects any package with fewer than ORD_ELEM_CNT elements before the parser runs. An upcoming change, however, relaxes that check to accept shorter packages. Bound the loop by the validated element count as well, so it stops at whichever comes first, the per-type count or the real package size, for (elem = 1, eloc = 1; eloc < ORD_ELEM_CNT && elem < order_obj_count; elem++, eloc++) order_obj_count is the validated element count, now correctly forwarded from the caller. No functional change for packages that enumerate correctly today. Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260709165900.30615-3-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
10 daysplatform/x86: hp-bioscfg: pass validated element count to package parsersMuhammad Bilal
The per-type package parsers are handed the wrong element count. hp_init_bios_package_attribute() validates obj->package.count and then calls one of the five hp_populate_*_package_data() wrappers (string, integer, enumeration, ordered list, password). Each wrapper forwards a count to its hp_populate_*_elements_from_package() parser, but instead of forwarding the validated obj->package.count it derives the count from elements[0]. elements[0] is the NAME field and is always an ACPI_TYPE_STRING, so reading ->package.count from it in fact reads ->string.length through the union acpi_object. The parsers thus bound themselves against the length of the name string rather than against the real number of elements in the package. This is safe today because hp_init_bios_package_attribute() refuses any package that has fewer than the type's element count, so a parser only ever runs on a full package and never reads past it regardless of the bogus bound. An upcoming change relaxes that check to accept shorter packages. Once a parser can receive fewer elements than its per-type count, a bound taken from the name length no longer reflects the array size, and the "elem < count" loop conditions and "elem + n >= count" sub-loop guards read past the end of elements[] - an out-of-bounds heap read. Forward the validated obj->package.count to every *_package_data() wrapper so the parsers bound themselves against the real package size. This does not change behaviour for the packages that enumerate correctly today and is a prerequisite for accepting shorter packages safely. Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260709165900.30615-2-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error pathMa Ke
ecl_ishtp_cl_probe() acquires a reference to an ACPI device via acpi_find_eclite_device() but fails to release it in the error path when acpi_opregion_init() fails. This results in a reference count leak, preventing proper cleanup of the ACPI device. Calling path: acpi_find_eclite_device() -> acpi_dev_get_first_match_dev() -> acpi_dev_get_next_match_dev() -> bus_find_device() -> get_device(). Found by code review. Signed-off-by: Ma Ke <make_ruc2021@163.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Cc: stable@vger.kernel.org Fixes: 7b6bf51de974 ("platform/x86: Add Intel ishtp eclite driver") Link: https://patch.msgid.link/20260624014910.1226446-1-make_ruc2021@163.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-wmi: Add dual-channel PWM fan controlKürşat Abaylı
Currently, manual fan control on supported HP models uses a single PWM value for both CPU and GPU fans, linking their speeds via a hardcoded gpu_delta offset. This prevents userspace tools from managing the thermal profiles of the CPU and GPU independently. Refactor the hwmon implementation to support independent dual-channel PWM control: - Split the single 'pwm' state into 'cpu_pwm' and 'gpu_pwm'. - Expose a second PWM channel ('pwm2') to userspace via hwmon_channel_info. - Remove the gpu_delta mechanism entirely. The 'pwm1_enable' mode remains shared, as the underlying hardware does not support per-fan modes. When switching to manual mode, both fans are smoothly initialized to their current RPMs. Additionally, ensure that the HP_FAN_SPEED_AUTOMATIC flag is isolated from rpm_to_pwm mathematical interpolations during mode resets to prevent unintended fan states. Tested on: HP Victus 16-s0xxx Tested-by: Radhey Kalra <radheykalra901@gmail.com> Signed-off-by: Kürşat Abaylı <hello@kursatabayli.dev> Link: https://patch.msgid.link/20260707203740.55369-1-hello@kursatabayli.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: use cleanup.h to manage tunablesMarco Scardovi
Convert init_rog_tunables() to use the cleanup infrastructure to automatically free ac_rog_tunables if dc_rog_tunables allocation fails. By declaring local pointers with the __free(kfree) attribute, the manual kfree() in the error path can be removed. Upon successful initialization, the ownership is transferred to the global struct using no_free_ptr(). Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi <scardracs@disroot.org> Link: https://patch.msgid.link/20260707213741.6515-3-scardracs@disroot.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: fix Use-After-Free and memory leak in driver initMarco Scardovi
In init_rog_tunables(), if dc_limits are defined and allocating dc_rog_tunables fails, the already allocated ac_rog_tunables gets freed but the pointer stored in asus_armoury.rog_tunables[ASUS_ROG_TUNABLE_AC] is not cleared. Since init_rog_tunables() returns void, the driver initialization continues, which can lead to a Use-After-Free (UAF) when asus_fw_attr_add() accesses the freed AC tunables pointer. Additionally, if init_rog_tunables() succeeds but asus_fw_attr_add() fails, the allocated tunables are not freed, resulting in a memory leak. Fix these issues by making init_rog_tunables() return an error code and propagating it in asus_fw_init(). Defer setting the global pointers in asus_armoury.rog_tunables until both tunables have been successfully allocated. If asus_fw_attr_add() fails, release the allocated resources using a standard goto rollback block in asus_fw_init(). Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi <scardracs@disroot.org> Link: https://patch.msgid.link/20260707213741.6515-2-scardracs@disroot.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: lg-laptop: Fix keyboard backlight support on LG Gram 16T90SPArmin Wolf
On the LG Gram 16T90SP, the ACPI firmware will only accept the values 0x80, 0xA2 and 0xA4 when setting the keyboard backlight. After a bit of research using ACPI tables from older models it seems that bit 8 is supposed to be always written as 1. Fix the keyboard backlight support on this model by always setting bit 8 inside the argument passed to the WMAB ACPI control method. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260708195553.7762-6-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: lg-laptop: Improve WMAB control method supportArmin Wolf
The WMAB ACPI control method can return two kinds of results: 1. A ACPI integer containing the result. 2. A ACPI buffer containing the result and an error code. Devices implement one of those mechanisms, but not both. Extend lg_wmab() to abstract away the differences between both mechanisms to fix keyboard backlight support on newer devices. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260708195553.7762-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: lg-laptop: Add support for additional eventsArmin Wolf
Newer devices support a number of additional events: - 0x0: Placeholder event - 0x78: Mute audio - 0xf070002: Open settings - 0x30010000/0x30010001: Hotkey combination pressed/released - 0x40020000: Disable camera - 0x40020001: Mute microphone - 0x40030001: Fn-lock Map those events onto appropriate key codes. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260708195553.7762-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: lg-laptop: Add support for native ACPI eventsArmin Wolf
LG devices support two interfaces for receiving events: - the WMI-based interface currently being used by the driver - a ACPI-based interface similar to the WMI-based interface Older devices use the WMI-based interface by default and need to be manually switched into ACPI mode. Newer devices however only support the ACPI-based interface, preventing the current driver from receiving events on them. Fix this by always using the native ACPI-based interface for receiving events. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260708195553.7762-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: lg-laptop: Fix LED resource handlingArmin Wolf
The event notification callback might access kbd_backlight even when it was not successfully registered with the LED subsystem. The same happens inside acpi_remove(), where the LED devices are unregistered unconditionally. Fix this by tracking the availability of the kbd_backlight LED device and use devm_led_classdev_register() to let devres take care of unregistering the LED devices during removal. For this the parent device of the LED devices is changed to the native platform device. Fixes: ae26278829a8 ("platform/x86: lg-laptop: Use correct event for keyboard backlight FN-key") Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260708195553.7762-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: thinkpad_acpi: Add USB-C Security (USCS) supportVishnu Sankar
Newer ThinkPad systems expose a USB-C Security (Restricted Mode) feature. When active, USB-C data connections are disabled while power delivery is preserved. This is useful for kiosk and physically-secured deployments. Hardware interface: The HKEY device exposes a read-only ACPI method USCS(): Return value bit layout: Bit 16 : Capability flag (1 = feature present on this SKU) Bit 0 : Current state (0 = security OFF, 1 = security ON) The sysfs attribute is read-only. The Fn+U followed by Fn+S hotkey chord is the only way to toggle the hardware state. Hotkey: Fn+U followed by Fn+S generates HKEY event 0x131e. sysfs interface: /sys/devices/platform/thinkpad_acpi/usb_c_security (read-only) "enabled\n" -- data connections are currently blocked "disabled\n" -- data connections are currently allowed The attribute is hidden on SKUs where the USCS capability bit (bit 16) is not set, so there is no ABI impact on unsupported hardware. Suggested-by: Mark Pearson <mpearson-lenovo@squebb.ca> Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com> Link: https://patch.msgid.link/20260709021504.465792-1-vishnuocv@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: Add power limits quirk for FA608WVMarco Scardovi
Add power limits quirk entry for ASUS ROG FA608WV laptop. The limits are extracted from the device's ThrottleGear XML configuration file for the 'Ryzen' profile. Signed-off-by: Marco Scardovi <scardracs@disroot.org> Link: https://patch.msgid.link/20260701164003.4271-1-scardracs@disroot.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: add support for HN7306EA and HN7306EACFlávio Barroso Neves
Add TDP data for laptop models HN7306EA and HN7306EAC. Signed-off-by: Flávio Barroso Neves <flaviobn@gmail.com> Link: https://patch.msgid.link/20260705195126.17120-1-flaviobn@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: Add power limits for ROG Strix SCAR 16 (G635LX)Avi Fenesh
Add the AC and DC power limit definitions for the ASUS ROG Strix SCAR 16 2025 (G635LX), enabling the nv_tgp, nv_dynamic_boost and ppt_pl*_* tuning attributes on this model. Without an entry in the power_limits table the attributes are not exposed (has_valid_limit() returns false) and the firmware power knobs cannot be controlled. The G635LX ships an NVIDIA RTX 5090 Laptop GPU (150 W base TGP + 25 W Dynamic Boost = 175 W max, per the ASUS specification) and an Intel Core Ultra 9 275HX, matching the ROG Strix SCAR 18 (G835LW). The limits are therefore taken from the G835LW sibling entry and the ASUS specification rather than dumped from this board's firmware. Testing on a G635LX confirmed the attributes populate with this entry and that writing nv_dynamic_boost changes the measured GPU power draw (~151 W at minimum, ~169 W at maximum during inference), i.e. the limits reach firmware. Signed-off-by: Avi Fenesh <aviarchi1994@gmail.com> Link: https://patch.msgid.link/20260621130204.103566-1-aviarchi1994@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: Add power limits quirk for FA401KMMarco Scardovi
Add power limits quirk entry for ASUS ROG FA401KM laptop. The limits are extracted from the device's ThrottleGear XML configuration file for the 'Ryzen' profile. Signed-off-by: Marco Scardovi <scardracs@disroot.org> Link: https://patch.msgid.link/20260621123055.5465-2-scardracs@disroot.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)Krishna Chomal
The HP OMEN MAX 16-ak0xxx (board ID: 8DD6) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. After testing we know that (similar to another HP Omen Max 16 device, board ID 8D87), the embedded controller on this board does not expose thermal profile which means we have to intentionally disable EC readback. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_no_ec_thermal_params. Testing on board 8DD6 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Yahia Ahmed <yahmedd043@gmail.com> Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260623141314.33947-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: huawei-wmi: add ACPI fallback for Fn-lock on newer modelsShaposhnikov Daniil
Newer Huawei laptops (e.g. FLMH-XX / MateBook 14 2024) no longer support the legacy WMI interface for Fn-lock control. Instead, they expose direct ACPI methods \GFRS and \SFRS (Get/Set Fn key Reversal Status) which communicate with the EC via registers 0x6B (read) and 0x6C (write). Add huawei_acpi_fn_lock_get() and huawei_acpi_fn_lock_set() helpers that use acpi_evaluate_object() to call these methods. Both huawei_wmi_fn_lock_get() and huawei_wmi_fn_lock_set() now probe for \GFRS/\SFRS via acpi_has_method() first and fall back to the legacy WMI path if not present. Tested on: HUAWEI FLMH-XX (MateBook 14 2024), CachyOS (kernel 7.0.9-1-cachyos). Signed-off-by: Shaposhnikov Daniil <2minesweeper2@gmail.com> Link: https://patch.msgid.link/20260525130058.7408-2-2minesweeper2@gmail.com [ij: removed a few blank lines and "legacy"s from comments] Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: topstar-laptop: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_name() and acpi_device_class() which are never read afterward, so make it stop doing that. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/12951216.O9o76ZdvQC@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: xo15-ebook: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_class() which is never read afterward, so make it stop doing that and drop the two symbols defined specifically for this purpose. Likewise, acpi_device_name() set by the driver is only used for input class device name initialization and the "EBook Switch" string literal may as well be used directly for that, so make the driver do so and stop setting acpi_device_name(), which allows the symbol defined specifically for this purpose to be dropped. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2731795.Lt9SDvczpP@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: toshiba_haps: Do not use uninitialized device_classRafael J. Wysocki
The pnp.device_class string in the ACPI companion of the platform device used for binding the driver is never initialized, so passing it to acpi_bus_generate_netlink_event() is effectively equivalent to passing an empty string literal to that function. Accordingly, make the driver do the latter instead of doing the former. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/1987644.CQOukoFCf9@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: toshiba_acpi: Do not use uninitialized device_classRafael J. Wysocki
The pnp.device_class string in the ACPI companion of the platform device used for binding the driver is never initialized, so passing it to acpi_bus_generate_netlink_event() is effectively equivalent to passing an empty string literal to that function. Accordingly, make the driver do the latter instead of doing the former. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/3642854.QJadu78ljV@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: sony-laptop: Stop setting acpi_device_class()Rafael J. Wysocki
Since acpi_device_class() set by the driver is only used for generating ACPI netlink events and the "sony/hotkey" string literal may as well be used directly for this purpose, make the driver do so and stop setting acpi_device_class() in it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/9664323.CDJkKcVGEf@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: panasonic-laptop: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_name() and acpi_device_class() which are never read afterward, so make it stop doing that and drop the symbols defined specifically for this purpose. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/3979672.kQq0lBPeGt@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: thinkpad_acpi: Stop setting acpi_device_class()Rafael J. Wysocki
To facilitate the removal of device_class from struct acpi_device_pnp in the future, make the driver store the device class string used for generating ACPI netlink events in a new device_class field in struct ibm_struct. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/23182921.EfDdHjke4D@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: fujitsu-tablet: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_class() which is never read afterward, so make it stop doing that and drop the symbol defined specifically for this purpose. For consistency, also make it stop setting acpi_device_name() and add a name field to the "fujitsu" structure for storing the name string used during input class device initialization. While at it, use scnprintf() instead of snprintf() for populating the name and phys fields of the "fujitsu" structure. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2378407.iZASKD2KPV@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: fujitsu-laptop: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_name() that are only used for printing messages and initializing input class device names. Since ACPI_FUJITSU_BL_DEVICE_NAME and ACPI_FUJITSU_LAPTOP_DEVICE_NAME can be used directly in all of those cases, make the driver do so and stop setting acpi_device_name() in it. Likewise, acpi_device_class() set by the driver are never read afterward, so make the driver stop setting it and drop the symbol defined specifically for this purpose. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Jonathan Woithe <jwoithe@just42.net> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/3441919.aeNJFYEL58@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: eeepc-laptop: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_name() which is never read afterward, so make it stop doing that and drop the symbol defined specifically for this purpose. Likewise, acpi_device_class() set by the driver is only used for generating ACPI netlink events, but the "hotkey" string literal may as well be used directly for that, so make the driver do so and stop setting acpi_device_class(), and drop the symbol defined specifically for this purpose. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2291726.irdbgypaU6@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-laptop: Stop setting acpi_device_name/class()Rafael J. Wysocki
The driver sets acpi_device_name() which is never read afterward, so make it stop doing that and drop the symbol defined specifically for this purpose. Likewise, acpi_device_class() set by the driver is only used for generating ACPI netlink events, but the "hotkey" string literal may as well be used directly for that, so make the driver do so and stop setting acpi_device_class(), and drop the symbol defined specifically for this purpose. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/5106055.GXAFRqVoOG@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86/amd/hsmp: Gate the data plane on a fully initialized socketMuralidhara M K
hsmp_parse_acpi_table() published sock->dev before hsmp_read_acpi_crs() had mapped virt_base_addr. sock->dev is the readiness gate for the lock-free data plane, so on a multi-socket system - where socket 0 exposes /dev/hsmp before later sockets finish probing - an ioctl aimed at a socket still in bring-up could pass the gate and dereference a NULL virt_base_addr. Publish sock->dev last with smp_store_release() once virt_base_addr, the mailbox offsets and the semaphore are initialized, and read it with smp_load_acquire() in hsmp_send_message() so a non-NULL dev guarantees the rest of the socket state is visible. Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com> Link: https://patch.msgid.link/20260629155634.1807598-5-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86/amd/hsmp: Pass struct device explicitly to ACPI mailbox parsersMuralidhara M K
hsmp_read_acpi_crs() and hsmp_read_acpi_dsd() read the ACPI handle and emit error messages via sock->dev. Pass the struct device explicitly to both helpers instead of reading it back from sock->dev. This is a pure refactor with no functional change; it prepares for publishing sock->dev as the data-plane readiness gate only after the socket has been fully initialized, so the parsers must not depend on sock->dev already being set. Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com> Link: https://patch.msgid.link/20260629155634.1807598-4-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86/amd/hsmp: Validate _DSD mailbox sub-package element countMuralidhara M K
hsmp_read_acpi_dsd() dereferenced elements[0] and elements[1] of each mailbox sub-package before confirming the package actually held two elements, allowing an out-of-bounds read on a malformed _DSD. Verify package.count >= 2 first, then fetch the string and integer objects. Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://patch.msgid.link/20260625123337.886435-3-muralidhara.mk@amd.com Link: https://patch.msgid.link/20260629155634.1807598-3-muralidhara.mk@amd.com Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-20 16:45:25 +0000