summaryrefslogtreecommitdiff
path: root/drivers/platform
AgeCommit message (Collapse)Author
37 hoursMerge tag 'mfd-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - MediaTek MT6397: Add mt6323 AUXADC support - MediaTek MT6397: Add mt6323 EFUSE support - Spreadtrum SC27xx: Add SC2730 regulator cell Improvements & Fixes: - Apple SMC: Fix key count endianness annotation - Azoteq IQS62x: Reject zero-length firmware records - ChromeOS EC: Introduce cros_ec_read_features helper and read features during probe to catch transfer errors - Cirrus Logic CS42L43: Fix regmap defaults ordering - Cirrus Logic CS42L43: Remove redundant NULL checks on SoundWire - Congatec Board Controller: Fix teardown ordering in cgbc_remove() - HP iPAQ Micro: Fix out-of-bounds stack read in ipaq_micro_str - Marvell 88PM886: Initialize the battery page - QNAP MCU: Keep the reply buffer alive past a command timeout - RAVE SP: Validate received frame payload lengths - Silicon Labs Si476x: Drop duplicate NULL checks - Silicon Labs Si476x: Modernize GPIO handling - Silicon Motion SM501: Fix potential memory leaks during remove - UCB1x00: Convert Assabet gpio-keys to use software nodes and register software node for GPIO controller - Viperboard: Fix native fields type in structures as little-endian - Viperboard: Remove redundant NULL check before kfree() - X-Powers AXP20x: Preserve other control bits when powering off Cleanups & Refactoring: - Core: Drop unused assignment of spi_device_id driver data - Core: Initialize spi_device_id arrays using member names - Core: Unify style of spi_device_id arrays - Maintainers: Add Intel LPSS section to follow the changes - Maintainers: Add a mailing list entry to MFD - Cirrus Logic CS42L43: Format sdw_device_id table - Cirrus Logic CS42L43: Use new SoundWire enumeration helper - ROHM PMIC: Factor out power button registration and convert gpio-keys to use software nodes - ST-Ericsson DB8500: Fold dbx500 header into db8500 Device Tree Binding Updates: - Core: Add techvision vendor prefix - Marvell 88PM886: Allow vbus regulator - MediaTek MT8195 SCP: Add support for MT8189 SoC - Qualcomm SPMI PMIC: Document PMG1110 - Qualcomm SPMI PMIC: Document haptics device - Qualcomm TCSR: Add compatible for Hawi and Maili SoCs - Qualcomm TCSR: Add compatible for Shikra - Qualcomm TCSR: Document the IPQ9650 TCSR block - STMicroelectronics STMPE: Fix typo st,stmpe601 (should be st,stmpe610) - Syscon: Add ESWIN EIC7700 compatible - Syscon: Allow syscon compatible for Loongson-2K0300 chip id - Syscon: Disallow simple-bus with syscon - Syscon: Drop custom select for older dtschema - TI OMAP USBHS TLL: Convert to DT schema" * tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (45 commits) mfd: cs42l43: Fix regmap defaults ordering dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip id dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatible mfd: qnap-mcu: keep the reply buffer alive past a command timeout dt-bindings: mfd: qcom,tcsr: Document the IPQ9650 TCSR block mfd: macsmc: Fix key count endianness annotation dt-bindings: mfd: qcom,spmi-pmic: Document haptics device mfd: iqs62x: Reject zero-length firmware records mfd: rave-sp: validate received frame payload lengths mfd: sm501: Fix potential memory leaks during remove mfd: viperboard: Fix native fields type in structures as little-endian mfd: si476x-i2c: Get rid of duplicate NULL checks dt-bindings: mfd: Convert OMAP USB TLL to DT schema mfd: cgbc: Fix teardown ordering in cgbc_remove() mfd: mt6397-core: Add mt6323 AUXADC support dt-bindings: mfd: qcom,tcsr: Add compatible for Hawi and Maili SoCs mfd: rohm: Factor out power button registration mfd: ucb1x00: Convert Assabet gpio-keys to use software nodes mfd: ucb1x00: Register software node for GPIO controller mfd: cs42l43: Tidy up formatting on sdw_device_id table ...
5 daysMerge tag 'platform-drivers-x86-v7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen "Highlights: Major refactoring effort: stop setting acpi_device_name/class() and pnp.device_class to facilitate their eventual removal Many rollback/remove path fixes (presumably mostly found by AI) Miscellaneous cleanups / refactoring / improvements amd/halo: - Add Halo RGB LED driver amd/hsmp: - Properly serialize probe, remove, and data paths - Add support for protocol v7 used by Family 1AH Model 80H - Fix error checking corner cases (largely from AI review) - Reject negative power cap amd/pmc: - Improve behavior on platforms that do not support STB - Add T14 Gen2 AMD (20XL) to s2idle quirk list amd/pmf: - Add ioctl interface to retrieve device metrics - Add support for new metrics tables used by Family 1AH Model 80H qcom-hamoa-ec (arm64): - Reject short responses asus-nb-wmi: - Support ProArt key on ASUS ProArt PX13 asus-armoury: - Gate PPT writes behind active fan curve - Add power limits for more models dell-wmi-base: - Fix handling of ultra performance key dell-wmi-sysman: - Don't hex dump attribute security buffer hp-bioscfg: - Various fixes - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2) lg-laptop: - Fix LED resource handling - Add support for events used in newer models - Fix keyboard backlight support on LG Gram 16T90SP hp-wmi: - Generalize thermal params to board params - Manage CPU and GPU PWM independently - Add GPU MUX switch support - Add Victus 15-fb0xxx support - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN 16-wf0xxx, and OMEN board ID 8D88 support - Add OMEN Transcend 16-u0xxx support huawei: - Add support for Fn-lock ACPI interface found on newer Huawei laptops such as MateBook 14 2024 ISST: - Improve input validation (many fixes) - Disallow SST-CP (core-power) feature if perf profile add fails lenovo/yb9-kbdock: - Add driver for Yoga Book 9 14IAH10 lenovo/ymc: - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11 - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input nodes msi-ec: - Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support msi-wmi: - Add MSI Claw M-Center keys support oxpec: - Add support for OneXPlayer X2 Mini Pro redmi-wmi: - Report kbd backlight cycle, OEM preset power mode, and FnLock toggle events to userspace samsung-galaxybook: - Add Samsung Galaxy Book6 Pro support thinkpad_acpi: - Add USB-C Security support uniwill-laptop: - Add keyboard backlight, AC auto boot, and USB powershare support - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support - Make lightbar max brightness configurable and add support for LAPQC71A/B" * tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (152 commits) platform/x86: think-lmi: Fix current password length check platform/x86: redmi-wmi: report EC state change events MAINTAINERS: update Intel PMC Core maintainer contact platform/x86: oxpec: Add support for OneXPlayer X2 Mini Pro platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330 platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware platform/x86: think-lmi: Fix certificate thumbprint sysfs output mlxbf-bootctl: fix the build error with FIELD_PREP() platform/x86: think-lmi: Free system certificate signatures platform/x86: ISST: Add a NULL check for sst_inst[] platform/x86: ISST: Return error during profile addition platform/x86: ISST: Just allow 2 bits for SST feature enable platform/x86: ISST: Use PP level enable mask platform/x86: ISST: Validate parameter for frequency and priority platform/x86: ISST: Validate parameter for core power state platform/x86: ISST: Validate max level for set feature platform/x86: ISST: Validate logical CPU id and clos id platform/x86: ISST: Validate level in perf mask ioctls platform/x86: ISST: Validate socket ID in clos_assoc ioctl platform/x86/amd/hsmp: Reject negative power cap writes in hwmon ...
10 daysMerge tag 'driver-core-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "container_of: - Apply typeof_member(), remove the local __mptr variable to eliminate variable shadowing warnings on nested container_of() calls, and remove unnecessary parentheses core: - Add driver name to probe debug print for initcall_debug - Avoid repeatedly printing the same 'Fixed dependency cycle' log - Unwind device_add() on attribute creation failure in attribute_container_add_class_device() - Remove statistics group if encryption group creation fails in transport_add_class_device() debugfs: - Fix lockdown check for mmap_prepare() - Warn if file creation failed due to uninitialized debugfs device property: - Implement fw_devlink support for software nodes by adding software_node_add_links(), which creates fwnode links from DEV_PROP_REF properties to enable automatic probe ordering. Add kunit-managed fwnode helpers and test coverage - Fix infinite loop in fwnode_for_each_child_node() when the secondary fwnode has more than one child. Add test cases - Fix out-of-bounds access in software_node_get_reference_args() when called with index -1 (UINT_MAX) - Refactor to use RAII approach with __free() - Add Bartosz Golaszewski as software node reviewer firmware loader: - Fix race where a sysfs fallback request can complete before being queued as pending, leading to a use-after-free on the next fallback request - Reject 0-size built-in firmware and fail the build on empty firmware files in CONFIG_EXTRA_FIRMWARE kobject: - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros and allow the constification of kobject attributes, enabling them to reside in read-only memory platform: - Provide platform_device_set_of_node(), platform_device_set_fwnode(), and platform_device_set_of_node_from_dev() helpers that encapsulate firmware node reference counting for dynamically allocated platform devices Convert all in-tree users that manually assigned dev.of_node or dev.fwnode, fixing a pre-existing refcount bug in powermac. Switch to counting references of all firmware node types, not only OF nodes - Unify the release path for dynamically allocated platform devices by removing platform_device_release_full(). Amend the fwnode setter API contract to warn if a primary software node is overwritten. Add KUnit tests for correct software node removal on device unregistration Rust: - Auxiliary: - Add registration_data_with() closure-based API for invariant ForLt types - Debugfs: - Migrate BinaryWriter and BinaryReaderMut trait requirements from kernel::transmute traits to zerocopy traits - Device: - Add BoundInternal device context and InternalBoundContext trait for bus abstractions that need internal access to a bound device. - Make the lifetime on Core and CoreInternal invariant to prevent coercion to shorter lifetimes - Devres: - Fix race between concurrent revokers where the losing revoker could return before the winning revoker finished dropping the inner data, causing use-after-free. - Ensure revocation is complete before the device finishes unbinding by making the synchronization bidirectional. - Add DevresLt<F: ForLt>, a wrapper around Devres that shortens 'static back to the caller's borrow scope. Implement ForLt and CovariantForLt for Bar, IoMem, and ExclusiveIoMem - Driver: - Switch from index-based to pointer-based device ID info lookup, storing static references in driver_data. Centralize device ID handling in device_id.rs, removing the open-coded ACPI/OF matching logic and duplicate ID table from driver.rs - I/O: - Make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add IoSysMap as sum type of Mmio and SysMem. Add copying methods (memcpy_{from,to}io()) and read_val()/write_val() for typed access. - Replace dma_read!()/dma_write!() with io_read!()/io_write!() for primitives and copying methods for aggregates; drop the old macros. Convert nova-core to use I/O projection. - Fix internal shortcut rule dispatch in the register!() macro, remove unused rule arguments, and use path fragments for alias destinations - IRQ: - Make irq::Registration compatible with lifetime-bound drivers by removing the 'static bound on Handler/ThreadedHandler and replacing Devres<RegistrationInner> with direct request_irq()/free_irq() calls. Handlers can now directly own lifetime-bound device resources - PCI: - Convert IrqVectorRegistration to a lifetime-annotated owning type, giving drivers explicit control over the allocation lifetime. IrqVector embeds a resolved IrqRequest, making the conversion infallible. Remove the redundant request_irq()/request_threaded_irq() wrappers from pci::Device. - Add pci_irq_type() C helper and expose it via irq_type() on IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX, PCI_IRQ_MSI, or PCI_IRQ_INTX. - Mark pci::Device refcount methods inline - Serdev: - Add Rust abstractions for the serial device bus, including serdev::Driver trait, serdev::Device wrapping struct serdev_device, and serdev::Adapter implementing RegistrationOps. Includes a sample driver. Markus Probst takes over as serdev maintainer for both C and Rust code - Misc: - Split ForLt into a base trait (providing the Of<'a> GAT) and an unsafe CovariantForLt subtrait guaranteeing covariance, enabling invariant types (e.g. those containing Mutex<&'bound T>) to participate in the ForLt abstraction. - Fix Coherent read past EOF returning -ERANGE instead of zero. - Fix firmware example UB by avoiding null-pointer ARef misc: - Avoid iattr allocation in kernfs listxattr by using kernfs_iattrs_noalloc(). - Unregister SoC bus on early device registration failure. - Remove unused DMA_FENCE_TRACE Kconfig symbol. - Fix /sys/module path in comment. - Refactor ISA bus init to remove nested blocks. - Remove redundant nodemask clears in numa_init(). - Add kernel-doc for fwnode_operations and sys_soc.h, mark internal property data as private for kernel-doc, and add property.h/fwnode.h to driver-api infrastructure docs. - Add MAINTAINERS entry for sys_soc.h" * tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (129 commits) rust: pci: expose the allocated interrupt type PCI: Add pci_irq_type() to query the allocated interrupt type rust: pci: remove request_irq() and request_threaded_irq() from Device rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector rust: pci: convert IrqVectorRegistration to a lifetime-managed owning type kernfs: avoid iattr allocation in listxattr rust: serdev: use ThisModule::as_ptr() instead of field access ACPI/IORT: use platform_device_set_fwnode() ACPI/APMT: use platform_device_set_fwnode() firmware_loader: do not queue completed sysfs fallback requests rust: pci: Mark Device refcount methods inline rust: irq: make Registration compatible with lifetime-bound drivers rust: net/phy: remove expansion from doc rust: dma: return zero for Coherent reads past EOF rust: io: register: use path fragment for alias destination rust: io: register: remove unused rule arguments rust: io: register: dispatch shortcut rules internally MAINTAINERS: add sys_soc.h to DRIVER CORE rust: debugfs: remove unsafe blocks from traits impl for Vec rust: debugfs: migrate debugfs traits requirements to zerocopy ...
10 daysMerge tag 'media/v7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2-core: added ISP statistics support and per-block validation - v4l2-core: Allow unknown HDR10 white point and luminance - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor - New codec: Milos: VPU v2.0 codec support - isp driver: gained support for Dreamchip RPPX1 ISP framework - vsp1 driver: gained support for RZ/T2H and RZ/N2H - Novalake driver: gained CVS support for new NVL hardware - dvb-core: fix feed leak on failed DMX_ADD_PID - several driver fixes, cleanups and minor improvements * tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits) media: ipu-bridge: check all DMI entries when overriding sensor rotation media: v4l2-async: avoid deleting unlinked ASC entry on link error media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement media: intel/ipu6: fix async notifier cleanup leak on parse error media: staging/ipu7: fix async notifier UAF on probe error path media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() media: rcar-isp: Fix VSPX reference leaks media: rcar-isp: Release ISPCORE resources media: i2c: imx415: Release runtime PM reference on VBLANK error media: i2c: imx415: Return test pattern write errors media: renesas: vsp1: Declare index variables in for loop statement media: renesas: vsp1: Make reset control optional to support platforms without a reset line media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs media: nxp: imx8-isi: Add additional 32-bit RGB format support media: nxp: imx8-isi: Add 16-bit raw Bayer format support media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks media: nxp: imx8-isi: Correct color map between V4L2 and ISI ...
10 daysMerge tag 'sound-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It was a fairly busy development cycle - the changes spread over from the core side to leaf drivers, with lots of cleanups and enhancements. Here we go, some highlights: ALSA core: - Extension of ALSA control component list ABI - Locking optimization and RCU conversion of ALSA sequencer core - A few hardening fixes for UMP and sequencer core - Drop __bitwise and __force prefix from UAPI definitions ASoC: - Automatic DAI format selection code deployment across many drivers - Sorting of register default tables to prevent ordering issues in many drivers - Lots of code cleanups and refactoring - Updates in Qualcomm driver stack - New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek RT1321 VA1/2 and RT766/7 HD-audio: - Support for AW88399 HD-audio side codec for Lenovo Legion laptops - Support for Hygon and Lisuan HDMI controllers - Robustness fixes for wild device binding - Lots of quirks/fixups: Realtek and Conexant codecs for ASUS, Lenovo, Acer, etc USB-audio: - Support for Pioneer DJ DJM-S11 - Scarlett2/FCP private URB notification fixes - Extended quirk_flags to 64bit - Hardening fixes for 6fire, bcd2000, usx2y - Device-specific quirks for Mackie, Valeton, SPACETOUCH General: - Auto-cleanup for put_device() and firmware loading across multiple platforms" * tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits) ALSA: hda: Fix connection list comparison in proc output ALSA: docs: fix dead link to Intel HD-audio spec ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio ALSA: hda: Add Lisuan HDMI controller and codec support ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F) ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57 ASoC: tas2783-sdw: do not treat read-only Controls as writable ASoC: SOF: validate topology volume range before allocation ASoC: cs35l56: Use IRQ provided by the SoundWire core soundwire: bus_type: Create IRQ mapping before calling driver probe() ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq() ASoC: cs35l56: Request IRQ in cs35l56_common_probe() ALSA: core: Fix use-after-free in snd_card_do_free() ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper ASoC: dt-bindings: es8316: Fix supply property constraints ALSA: seq: midi: Serialize input teardown with event_input ...
10 daysMerge tag 'chrome-platform-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New: - Add post_power_on_delay_ms for Hana in of_hw_prober Improvements: - Use dumb trackpad prober for Spherion in of_hw_prober Fixes: - Check bound of firmware-reported data in cros_ec_sensorhub and cros_ec_typec - Fix memory overread in cros_ec_sensorhub - Fix resource leak in cros_ec_debugfs - Clamp payload length for LIGHTBAR_CMD_SET_PROGRAM_EX in cros_ec_lightbar Cleanups: - Drop unused platform_device_id driver data - Remove redundant log" * tag 'chrome-platform-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: of_hw_prober: Add delay for hana trackpads platform/chrome: lightbar: Limit payload to max packet size platform/chrome: cros_ec_debugfs: Unregister panic notifier platform/chrome: cros_ec_debugfs: Clean up console log on probe failure platform/chrome: cros_ec: Remove redundant dev_err() platform/chrome: sensorhub: Fix dropped timestamp events and log spam platform/chrome: sensorhub: Fix memory overread in ring handler platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count platform/chrome: of_hw_prober: Use dumb trackpad prober for Spherion platform/chrome: Drop unused assignment of platform_device_id driver data platform/chrome: sensorhub: Bound the EC-reported sensor number
10 daysMerge tag 'x86_cpu_for_v7.3_rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Get rid of static_cpu_has() - one less API to care about testing CPU features - Unify the handling of CPU core types (performance, efficient, etc) by mapping the vendor-specific types to Linux ones - Continuation of the work of Ahmed Darwish to centralize CPUID leaf representation * tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU: Rename struct cpuid_read_output to struct cpuid_output x86/cpu/scattered: Sort it properly x86/cpu: Use parsed CPUID(0x1) x86/lib: Add CPUID(0x1) family and model calculation x86/cpu: Use parsed CPUID(0x0) x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities x86/topology: Add TOPO_CPU_TYPE_LOW_POWER x86/topology: Name the AMD core-type values x86/topo: Map vendor CPU types to generic Linux such types x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist x86/cpu: Hide and rename static_cpu_has()
11 daysplatform/x86: think-lmi: Fix current password length checkThorsten Blum
current_password_store() checks the password length before removing the trailing newline, which can reject valid passwords that are exactly ->maxlen bytes long. It also passes ->maxlen to strscpy(), which truncates passwords without a newline. Use strchrnul() to measure the password length up to the newline, then copy that many bytes and add a trailing NUL terminator using strscpy(). Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Cc: stable@vger.kernel.org Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260818151635.37094-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: redmi-wmi: report EC state change eventsMusaev Ibragim
The Redmibook EC/firmware fully handles the keyboard backlight cycle, the OEM preset power mode (Fn+K) and the Fn lock toggle by itself, and sends a WMI event carrying the resulting state in the third payload byte. These events are currently swallowed with KE_IGNORE, so userspace never learns that the state changed and cannot give the user any feedback (OSD), even though the WMI event is the only notification channel for these EC-driven changes. Report them as key presses instead: - keyboard backlight cycle -> KEY_KBDILLUMTOGGLE - OEM preset power mode -> KEY_PERFORMANCE - Fn lock toggle -> KEY_FN_ESC Desktops that only look at the keycode get the usual hotkey behaviour; since sparse-keymap emits MSC_SCAN with the raw payload before the key event, an OSD daemon can additionally recover the exact new state from byte 2 (e.g. backlight Off/Low/High/Auto is 0x00/0x05/0x0a/0x80). Note that the power mode event must keep being read from the WMI device in any case: on the TM2209 the ACPI event handler (EV20) applies the mode change as a side effect of building the event payload for _WED. Tested on Redmi Book Pro 15 2023 (TM2209). Signed-off-by: Musaev Ibragim <atomicus.xyz@gmail.com> Link: https://patch.msgid.link/178405473606.25865.4048095379503614221@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: oxpec: Add support for OneXPlayer X2 Mini ProJeff Hagadorn
OneXPlayer X2 Mini Pro is a new Strix Halo handheld. It ships the same system board as the OneXPlayer APEX and uses the same registers as the OneXPlayer Fly devices. Add a quirk for it to the oxpec driver. Signed-off-by: Jeff Hagadorn <jeff@aletheia.io> Reviewed-by: Antheas Kapenekakis <lkml@antheas.dev> Link: https://patch.msgid.link/20260805183102.38408-1-jeff@aletheia.io Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330Andrew Onyshchuk
The ThinkPad Edge E330 with H3 firmware uses the non-standard EC fan register block. Without a matching quirk, thinkpad_acpi reads the legacy tachometer registers and reports 0 RPM. Add the H3 BIOS family to TPACPI_FAN_NS so the driver reads the fan period from EC register 0x95 using the existing non-standard reporting path. Tested on a ThinkPad Edge E330 with BIOS H3ET77WW and EC H3EC35WW. Signed-off-by: Andrew Onyshchuk <andryk.rv@gmail.com> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://patch.msgid.link/20260806154417.618575-1-andryk.rv@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmwareYaroslav Dudkov
Add the firmware string '17L1EMS1.107' to the ALLOWED_FW_13 array. This enables Embedded Controller support, including battery charge thresholds, for the MSI Katana GF76 11UEK (MS-17L1) laptop. Tested on MSI Katana GF76 11UEK with EC firmware 17L1EMS1.107 and BIOS E17L1IMS.312. Signed-off-by: Yaroslav Dudkov <aroslavdudkov622@gmail.com> Link: https://patch.msgid.link/20260807180553.869371-1-aroslavdudkov622@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: think-lmi: Fix certificate thumbprint sysfs outputThorsten Blum
cert_thumbprint() already returns the accumulated output length, but certificate_thumbprint_show() adds that value to count again, making the next line use the wrong offset. Errors returned by cert_thumbprint() are also ignored and their negative values added to count. Assign the total length to count instead and propagate errors correctly. Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate authentication support") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://patch.msgid.link/20260810120556.149416-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysmlxbf-bootctl: fix the build error with FIELD_PREP()Nikolay Kulikov
rsh_log_store() calls the FIELD_PREP() macro without including the required header file, resulting a build error: CC drivers/platform/mellanox/mlxbf-bootctl.o drivers/platform/mellanox/mlxbf-bootctl.c: In function ‘rsh_log_store’: drivers/platform/mellanox/mlxbf-bootctl.c:429:16: error: implicit declaration of function ‘FIELD_PREP’ [-Wimplicit-function-declaration] 429 | data = FIELD_PREP(MLXBF_RSH_LOG_TYPE_MASK, MLXBF_RSH_LOG_TYPE_MSG); | ^~~~~~~~~~ Fix this by including the <linux/bitfield.h> file. Fixes: e9d1b2d0f7d0 ("mlxbf-bootctl: Add sysfs file for BlueField boot log") Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260810-mellanox_fix_implicit_declaration-v1-1-352e647b8f28@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: think-lmi: Free system certificate signaturesThorsten Blum
Multi-certificate support also allows the system authentication object to store ->signature and ->save_signature, which leak when the driver is removed. Free the signatures to avoid leaking memory. Fixes: 5dcb5ef12590 ("platform/x86: think-lmi: Multi-certificate support") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://patch.msgid.link/20260810204106.165895-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Add a NULL check for sst_inst[]Srinivas Pandruvada
To be consistent with other places, add a NULL check for failed socket loading by checking isst_common.sst_inst[]. Fixes: d805456c712f ("platform/x86: ISST: Enumerate TPMI SST and create framework") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811222134.3912626-3-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Return error during profile additionSrinivas Pandruvada
If sst_add_perf_profiles() fails for memory allocation, it continues to allow SST-CP (core-power) feature. But in practice this is not very useful as to achieve some frequencies via SST-CP, an SST-PP (perf-profile) level change is required. Fixes: 0ab147bb840f ("platform/x86: ISST: Parse SST MMIO and update instance") Cc: HyeongJun An <sammiee5311@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811222134.3912626-2-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Just allow 2 bits for SST feature enableSrinivas Pandruvada
Currently only 2 features SST-TF and SST-BF are supported, so only allow bit 0 and bit 1. Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811221514.3905817-7-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Use PP level enable maskSrinivas Pandruvada
Add check for enabled levels only when reading MMIO. Some levels can be disabled by BIOS. If the level is not enabled, return an error. Reset the enable and allowed level masks if there is a failure to add a perf level. Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811221514.3905817-6-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Validate parameter for frequency and prioritySrinivas Pandruvada
Validate range for frequency and proportional priority while setting CLOS parameters. Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811221514.3905817-5-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Validate parameter for core power stateSrinivas Pandruvada
Allow only 0 or 1 for core_power enable and priority_type parameters. Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811221514.3905817-4-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Validate max level for set featureSrinivas Pandruvada
Validate the level before setting, so that it fails early instead of failing later when checking the bit mask for allowed levels. Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811221514.3905817-3-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Validate logical CPU id and clos idSrinivas Pandruvada
Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate MMIO offset. Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI") Cc: stable@vger.kernel.org Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260811221514.3905817-2-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Validate level in perf mask ioctlsHyeongJun An
isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] via _read_pp_level_info() and _read_bf_level_info(), but neither helper validates it first. The adjacent level-info helpers reject levels above max_level before reading the same per-level register block. Add the same bounds checks to the mask helpers, and reject disabled SST-PP levels in isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info(). This prevents out-of-bounds reads from the per-level offset table on invalid ioctl input. Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI") Fixes: 06a61df83209 ("platform/x86: ISST: Add SST-BF support via TPMI") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260807144003.3498972-3-sammiee5311@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: ISST: Validate socket ID in clos_assoc ioctlHyeongJun An
isst_if_clos_assoc() validates the user-supplied socket_id with 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is allocated with topology_max_packages() entries, so the valid index range is [0, topology_max_packages()). The '>' comparison lets socket_id == topology_max_packages() pass and index one entry past the array. In addition, isst_common.sst_inst[socket_id] is NULL for an in-range package that has no bound TPMI SST instance, and the pointer is used without a NULL check. Both the out-of-bounds entry and the NULL pointer are then dereferenced by map_partition_power_domain_id() and the following power_domain_info access. Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching the checks already performed by get_instance(). Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260807144003.3498972-2-sammiee5311@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86/amd/hsmp: Reject negative power cap writes in hwmonHemanth Selam
hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long and assigns "val / MICROWATT_PER_MILLIWATT" to msg.args[0], which is a __u32. MICROWATT_PER_MILLIWATT is an unsigned long, so a negative write to power1_cap (e.g. "echo -1 > power1_cap") is first converted to a huge unsigned value by the division and then stored into the u32 argument. As a result a nonsensical, multi-gigawatt socket power limit is sent to the SMU via HSMP_SET_SOCKET_POWER_LIMIT instead of the write being rejected. Reject negative values with -EINVAL before the conversion. Tested with HSMP enabled: CAP=$(dirname $(grep -l amd_hsmp_hwmon \ /sys/class/hwmon/hwmon*/name | head -1))/power1_cap # negative write echo -1000000 > $CAP ; echo "ret=$?" # valid positive write must still work echo 400000000 > $CAP ; echo "ret=$?" Before: # echo -1000000 > $CAP ; echo "ret=$?" ret=0 <- accepted; bogus limit sent to SMU # echo 400000000 > $CAP ; echo "ret=$?" ret=0 After: # echo -1000000 > $CAP ; echo "ret=$?" bash: echo: write error: Invalid argument ret=1 <- rejected with -EINVAL # echo 400000000 > $CAP ; echo "ret=$?" ret=0 <- valid write still works Fixes: 92c025db52bb ("platform/x86/amd/hsmp: Report power via hwmon sensors") Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260812090012.140193-1-hemanth.selam@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: advance elem past consumed array elementsMuhammad Bilal
The outer parsing loop in each attribute-type parser advances "elem" (the index into the ACPI package element array) by exactly one per iteration, but cases that consume multi-element arrays (PREREQUISITES, ENUM_POSSIBLE_VALUES, PSWD_ENCODINGS) read "size" consecutive elements without adjusting "elem" for the extra entries consumed beyond the first. The next outer iteration then re-reads a leftover element from the array just consumed instead of the next real property, and the type check fails on that stale element, aborting the parse with -EIO. This produces exactly the failure visible in dmesg on the test hardware, on every boot: Error expected type 2 for elem 13, but got type 1 instead hp_bioscfg: Returned error 0x3, "Invalid command value/Feature not supported" Fix by advancing "elem" by (size - 1) after each array-consuming loop, so the outer loop's own "elem++" lands on the correct next element. "eloc" is intentionally left alone: it indexes the logical property schema, not the physical element array, and each array case is still exactly one logical property regardless of how many physical elements it spans. The defect is identical across all five attribute-type parsers (enum, integer, string, ordered-list, password), which were copy-pasted from the same template when the driver was introduced. Fixes: 6b2770bfd6f9 ("platform/x86: hp-bioscfg: enum-attributes") Fixes: 6f2c06d5a467 ("platform/x86: hp-bioscfg: int-attributes") Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes") Fixes: 4b2672ec71a3 ("platform/x86: hp-bioscfg: order-list-attributes") Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260812111829.172273-10-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsedMuhammad Bilal
The ACPI_TYPE_STRING case explicitly skips the string conversion for elem == ORD_LIST_ELEMENTS: if (elem != PREREQUISITES && elem != ORD_LIST_ELEMENTS) { ret = hp_convert_hexstr_to_str(..., &str_value, &value_len); if (ret) continue; } so by the time the ORD_LIST_ELEMENTS case in the eloc switch runs, str_value is NULL (it was freed and reset to NULL at the end of the previous iteration). That case then does: ret = hp_convert_hexstr_to_str(str_value, value_len, &tmpstr, &tmp_len); hp_convert_hexstr_to_str() rejects a NULL input with -EINVAL, which sends this function to exit_list, and exit_list unconditionally returns 0. The net effect is that any ordered-list attribute with elements present silently ends up with an empty elements list, with no error surfaced anywhere. Fix by converting the current element directly, order_obj[elem], the same way the PREREQUISITES case already handles its own array elements, instead of reusing the unrelated str_value/value_len left over from earlier processing. Fixes: 4b2672ec71a3 ("platform/x86: hp-bioscfg: order-list-attributes") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260812111829.172273-9-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: fix new_password_store() overwriting current_passwordMuhammad Bilal
current_password_store() and new_password_store() both call store_password_instance() with is_current = true: static ssize_t new_password_store(...) { return store_password_instance(kobj, buf, count, true); } so a write to new_password is routed to current_password instead, and the new_password field is never written by either sysfs entry point. Fix by passing false from new_password_store(), matching what the is_current parameter is meant to select. Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260812111829.172273-8-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: fix password encoding bounds checkGuangshuo Li
The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying the supported password encodings from the ACPI package. The outer loop only guarantees that elem is within password_obj_count. The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + pos_values accesses. A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(). Add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values]. Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Link: https://patch.msgid.link/20260708090937.740435-1-lgs201920130244@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: fix heap OOB read on empty password writeMuhammad Bilal
validate_password_input() computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline, without checking that length is nonzero first. Writing an empty string (a bare '\n') to current_password or new_password gives length == 0, and buf[length - 1] reads buf[-1], one byte before the heap allocation holding the copied input. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] Read of size 1 at addr ffff88811bd8da9f by task sh/13740 ... store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] current_password_store+0x14/0x20 [hp_bioscfg] ... The buggy address is located 23 bytes to the right of allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88) Reproduced identically via new_password_store. Execution continues past the bad read (the garbage byte only affects whether "length" is decremented by one), so the write completes and returns success; this is a pure information read past the buffer, not a crash, but it is still an out-of-bounds access KASAN correctly flags. Fix by only checking buf[length - 1] when length is nonzero. Fixes: 8646a3b5ee3a ("platform/x86: hp-bioscfg: passwdobj-attributes") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260812111829.172273-4-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()Muhammad Bilal
sk_store() and kek_store() strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if (buf[length - 1] == '\n') length--; bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL); but then pass the original "count" (not "length") as the copy size to hp_wmi_perform_query(), which memcpy()s that many bytes out of the "length"-sized allocation, reading one byte past it whenever the write ends in a newline, the normal case for a shell "echo" into sysfs. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg] Read of size 28 at addr ffff88813c8e2b80 by task python3/16022 ... sk_store+0xa7/0x240 [hp_bioscfg] kernfs_fop_write_iter+0x3e1/0x5d0 ... The buggy address is located 0 bytes inside of allocated 27-byte region [ffff88813c8e2b80, ffff88813c8e2b9b) Reproduced identically for kek_store, and at multiple write sizes (28, 57, 201 bytes), each time reading exactly one byte past a kmemdup() allocation one byte smaller than the write. Fix by passing "length" instead of "count" to hp_wmi_perform_query() in both functions. Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260812111829.172273-3-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()Muhammad Bilal
hp_get_string_from_buffer() clamps the converted string length against the destination buffer size with "size > dst_size", so when the converted length is exactly equal to dst_size, conv_dst_size is left at dst_size and the unconditional NUL terminator write dst[conv_dst_size] = 0; lands one byte past the destination buffer. This is the same shape of bug as the previously fixed off-by-one in hp_convert_hexstr_to_str(): the buffer is sized correctly for the content, but the terminator write is never checked against that size. Fix by changing the comparison to ">=" so conv_dst_size is always left with room for the terminator. All fixed-size destinations that reach this function (path[512], current_value[512], current_password/current_value[64], and the per-entry buffers in encodings[][512] and prerequisites[][512]) are affected. Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal <meatuni001@gmail.com> Link: https://patch.msgid.link/20260812111829.172273-2-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]Hilgad Montelo
acpi_pcc_retrieve_biosdata() rejects SINF packages only when pcc->num_sifr is strictly less than hkey->package.count, then unconditionally writes a trailing sentinel at pcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with exactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that write needs num_sifr strictly greater than package.count to stay in bounds -- num_sifr == package.count passes the existing check but still overflows by one element. This is exactly the case probe()'s existing num_sifr++ workaround ("Some DSDT-s have an off-by-one bug where the SINF package count is one higher than the SQTY reported value") is written to accommodate: when a DSDT's SINF package count equals SQTY+1, the workaround makes num_sifr equal to package.count, which is precisely the boundary that overflows here. Found via UBSan (array-index-out-of-bounds) on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements: num_sifr becomes 38 after the += 1 workaround, the loop correctly fills indices 0..37, and the sentinel write then targets index 38, one past the end -- a silent 4-byte heap overflow on kernels without CONFIG_UBSAN. Tightening the rejection check to num_sifr <= package.count would avoid the overflow but breaks probe() entirely on exactly this hardware, since num_sifr == package.count is the case the off-by-one workaround exists to support. Nothing else in the driver reads this sentinel value back, so simply skip the write when there is no room for it instead. Fixes: a3d0dbd18ce9 ("platform/x86: panasonic-laptop: simplify allocation of sinf") Cc: stable@vger.kernel.org Signed-off-by: Hilgad Montelo <hilgad.montelo@gmail.com> Link: https://patch.msgid.link/20260813221744.25668-4-hilgad.montelo@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: dell-wmi-sysman: Fix instance ID boundsHyeongJun An
The get_instance_id() macro walks the per-type attribute array with 'i <= instances_count'. Each array is allocated with exactly instances_count entries, so the valid range is [0, instances_count) and the last iteration reads one element past the end. On a name miss that out-of-bounds attribute_name is handed to strcmp(), which reads on until it finds a NUL byte. Every kobject in these ksets is built from an entry that was populated, so a miss does not look reachable from sysfs today. The bound is wrong either way and the read is out of bounds. The matching macro in hp-bioscfg carried the same off-by-one and was corrected by commit 25150715e0b0 ("platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro"). That macro takes a kobject pointer out of the out-of-bounds element and dereferences it, so it could fault. This one reads a char array. Use '<' to match the allocation. Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260814132535.4169956-1-sammiee5311@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: asus-armoury: add support for FX517ZRAbdElRahman Soliman
Add DMI match and power-limit table entry for the ASUS TUF Dash F15 (2022), board FX517ZR, an Alder Lake + RTX 3070 laptop. AC and DC min/max values for ppt_pl1_spl, ppt_pl2_sppt, nv_dynamic_boost and nv_temp_target were referenced from ASUS Armoury Crate's manual performance-tuning mode on Windows for this exact model. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: AbdElRahman Soliman <abdelrahman7987@gmail.com> Link: https://patch.msgid.link/20260816174118.28012-1-abdelrahman7987@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-wmi: Add OMEN board 8D88 thermal profile supportSuryansh Singh
The HP OMEN 16 (board ID: 8D88) supports the existing OMEN thermal profile handling. Add the DMI board name to hp_wmi_feature_boards[] so that the existing thermal profile support is enabled for this board. This enables the existing fan control and platform profile handling for 8D88. The board has been reported as working with this configuration in OmenCtl. Link: https://github.com/yunusemreyl/OmenCtl/commit/e3cde3842bb2ffbd697592dc08a6043dc7cccfd0 Signed-off-by: Suryansh Singh <technosfan14@gmail.com> Link: https://patch.msgid.link/20260818090828.27049-1-technosfan14@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-wmi: Add OMEN board 8A43 thermal profile supportSuryansh Singh
The HP OMEN 16-n0xxx AMD (board ID: 8A43) supports the existing OMEN thermal profile handling. Add the DMI board name to omen_thermal_profile_boards[] so that the existing thermal profile support is enabled for this board. This enables the existing fan control and platform profile handling for 8A43. The board has been reported as working with this configuration in OmenCtl. Link: https://github.com/yunusemreyl/OmenCtl/commit/39d03b62028555d3014085f0d9cb3eb57a501871 Signed-off-by: Suryansh Singh <technosfan14@gmail.com> Link: https://patch.msgid.link/20260818082925.14854-1-technosfan14@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-wmi: Add OMEN Transcend 16 8BB3 supportSuryansh Singh
The HP OMEN Transcend 16 (board ID: 8BB3) uses the existing OMEN v1 WMI interface but does not use the standard EC thermal profile parameters. Add the DMI board name to hp_wmi_feature_boards[] and map it to omen_v1_no_ec_board_params. This enables the existing board-specific handling for 8BB3, including platform profile and fan control support. Tested on: HP OMEN Transcend 16-u0xxx DMI Board Name: 8BB3 Platform profile registration, fan RPM reporting, and PWM fan control have been verified on this board. Link: https://github.com/arfelious/omen-fan-control/commit/5d7a893432f1075ebb030a4eccdc929c35d68d97 Signed-off-by: Suryansh Singh <technosfan14@gmail.com> Link: https://patch.msgid.link/20260817145206.148600-1-technosfan14@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
11 daysplatform/x86: hp-wmi: Add OMEN board 8BAA thermal profile supportSuryansh Singh
The HP OMEN 16-wf0xxx (board ID: 8BAA) has the same WMI interface as other OMEN boards and is compatible with the existing omen_v1_board_params. Add the DMI board name to hp_wmi_feature_boards[] table and map it to omen_v1_board_params. Without this entry, platform profile switching is unavailable, preventing fan RPM reporting and controlling. Tested on: HP OMEN 16-wf0xxx DMI Board Name: 8BAA It has been confirmed that the platform profile is registered successfully, and the fan RPMs are readable and controllable. Link: https://www.reddit.com/r/HPOmen/comments/1siukdu/guide_native_fan_control_on_hp_omen_16wfx0xxx/ Signed-off-by: Suryansh Singh <technosfan14@gmail.com> Link: https://patch.msgid.link/20260817121233.44636-1-technosfan14@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
12 daysMerge branch 'for-next' into for-linusTakashi Iwai
2026-08-13platform/chrome: of_hw_prober: Add delay for hana trackpadsChen-Yu Tsai
Up until now, the MT8173 elm/hana device tree has set the dedicated regulator supplying the trackpad as always-on, simply because the Elan driver was missing proper delays. As a result the delay for the Synaptics trackpad was also omitted, as it was not strictly required under such a model and delayed the availability of the trackpad to the user. The Elan driver recently gained proper delays after power-up, with adaptive skipping of the delay if the regulator was originally on. The I2C HID driver and I2C OF component prober library gained similar adaptive delay skipping. The device tree will be fixed to have the regulator not be always on, and proper post-power-on delay time added to the I2C HID device. Also add the post-power-on delay to the ChromeOS OF component prober, so that if the regulator is off at the time of probing, the prober knows to wait for the hardware to initialize. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Link: https://lore.kernel.org/r/20260811122011.3539250-8-wenst@chromium.org Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-08-10Merge branch 'acpi-video'Rafael J. Wysocki
Merge updates related to the ACPI video bus driver for 7.3-rc1: - Introduce helper function acpi_dev_is_video_device() and use it in the core ACPI device enumeration code, in the ACPI video bus driver, in the ACPI support code for I2C, in the PCI VGA driver, and in the x86 platform thinkpad_acpi driver (Andy Shevchenko) - Add a quirk to use the native backlight on Acer Nitro AN515-46 to the ACPI video bus driver (Marcos Paulo Medeiros) - Release PCI device reference after lookup in video_detect_portege_r100() in the ACPI video bus driver (Yuho Choi) * acpi-video: ACPI: video: Release PCI device reference after lookup ACPI: video: force native backlight on Acer Nitro AN515-46 platform/x86: thinkpad_acpi: Convert to use acpi_dev_is_video_device() helper PCI/VGA: Convert to use acpi_dev_is_video_device() helper i2c: acpi: Convert to use acpi_dev_is_video_device() helper ACPI: video: Convert to use acpi_dev_is_video_device() helper ACPI: scan: Convert to use acpi_dev_is_video_device() helper ACPI: utils: Introduce acpi_dev_is_video_device() helper
2026-08-10Merge tag 'v7.2-rc7' into driver-core-nextDanilo Krummrich
We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-03platform: arm64: qcom-hamoa-ec: reject incomplete responsesLinmao Li
qcom_ec_read() accepts short positive transfers, while both callers unconditionally consume every field in their fixed-size response. A short transfer can therefore make them use trailing stack bytes that were not returned by the device. The first response byte contains the number of payload bytes, excluding the byte count itself. A complete response of resp_len bytes must therefore report resp_len - 1 payload bytes. The existing check only rejects counts that do not fit in the response buffer and still accepts an incomplete payload. Require both the SMBus transfer length and the EC-provided payload count to match the expected response size. Fixes: 5c44f48e91de ("platform: arm64: Add driver for EC found on Qualcomm reference devices") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260728111924.4106898-1-lilinmao@kylinos.cn Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-08-03platform/x86: samsung-galaxybook: Add SAMB430 device IDRiccardo Squarcialupi
The Samsung Galaxy Book6 Pro (NP944XJG-KG4IT) exposes its SCAI ACPI device with HID SAMB430, which is not in the driver's device ID table, so the driver never binds and none of its features are available. Add SAMB430 to galaxybook_device_ids[]. Tested on an NP944XJG-KG4IT by forcing the bind via driver_override, which is equivalent to an ID table match. All driver features probe successfully: keyboard backlight LED, battery charge control end threshold, platform profile (low-power/quiet/balanced/performance), firmware attributes (power_on_lid_open, usb_charging), and the camera lens cover input switch. One optional feature probe fails harmlessly on this model: "failed to execute CSFI; device responded with failure code 0xff". This does not affect any of the features listed above. Assisted-by: Claude:claude-opus-5 Signed-off-by: Riccardo Squarcialupi <rikysquarcia@gmail.com> Link: https://patch.msgid.link/20260731125431.199902-1-rikysquarcia@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-08-03platform/x86/lenovo: Add Yoga Book 9 keyboard dock detection driverDave Carey
The Lenovo Yoga Book 9 14IAH10 ships with a detachable Bluetooth keyboard that magnetically attaches to the bottom (secondary) screen in one of two positions. The Embedded Controller tracks the attachment state in a 2-bit field called BKBD and signals changes via WMI event GUID 806BD2A2-177B-481D-BFB5-3BA0BB4A2285 (notify ID 0xEB on the WM10 ACPI device, _UID "GMZN"). The device contains embedded BMOF data (WQDD, 20705 bytes) documenting both WMI interfaces used by this driver: LENOVO_BTKBD_EVENT (event GUID): WmiDataId(1) uint32 Status. The ACPI _WED(0xEB) method returns EC.BKBD directly as an integer, so the notify callback receives BKBD without a separate query. LENOVO_FEATURE_STATUS_DATA (block GUID, WQAF method): returns an 8-byte buffer {uint32 IDs=0x00060000, uint32 Status=BKBD}. Used for the initial state read on probe and after resume. BKBD encoding: 0 = keyboard detached 1 = keyboard docked on top half of bottom screen 2 = keyboard docked on bottom half of bottom screen 3 = reserved (not observed in practice) This driver registers two WMI drivers sharing a module-level BLOCKING_NOTIFIER_HEAD: - The event driver (LENOVO_BTKBD_EVENT) uses .notify_new() to receive a pre-parsed wmi_buffer and fires the notifier chain with the BKBD value extracted from the buffer. - The block driver (LENOVO_FEATURE_STATUS_DATA) owns the input_dev in its per-device private struct. At probe time it registers a notifier_block on the chain and reads the initial BKBD state via wmidev_query_block(). The WMI buffer is parsed as struct lenovo_feature_status { __le32 id; __le32 status; }, and the ID field is verified before the status is used. - SW_TABLET_MODE=1 is reported when the keyboard is detached; SW_TABLET_MODE=0 when docked in either position (keyboard present). - The raw BKBD value is exposed via read-only sysfs attribute "keyboard_position". - BKBD state is re-read via wmidev_query_block() on resume from suspend or hibernation. Tested on: Lenovo Yoga Book 9 14IAH10 (model 83KJ), kernel 7.0. Acked-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Dave Carey <carvsdriver@gmail.com> Link: https://patch.msgid.link/20260728225545.1333610-3-carvsdriver@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-08-03platform/x86/lenovo: lenovo-ymc: Suppress probe on Yoga Book 9 14IAH10Dave Carey
The Yoga Book 9 14IAH10 (DMI product name "83KJ") has a dedicated yb9-kbdock WMI driver that registers an input device reporting SW_TABLET_MODE to track the detachable Bluetooth keyboard. lenovo-ymc also loads on this machine and creates an input node with the SW_TABLET_MODE capability bit set. For input switches, the presence of the capability bit has semantic meaning: userspace (e.g. GNOME) reads the switch state at startup from every node advertising the capability and does not expect more than one such node. Add a DMI match for the Yoga Book 9 14IAH10 to probe() so that lenovo-ymc returns -ENODEV on this hardware, leaving yb9-kbdock as the sole SW_TABLET_MODE source. The ymc_ec_trigger EC write, the only other action taken in response to a YMC event, is guarded by a separate DMI table that excludes this machine; no other functionality is affected. Signed-off-by: Dave Carey <carvsdriver@gmail.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260728225545.1333610-2-carvsdriver@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-08-03Merge branch 'for-linus' into for-nextTakashi Iwai
Pull 7.2 devel branch for put_device auto-clean fixes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-31platform/chrome: lightbar: Limit payload to max packet sizeAlexis Savery
The LIGHTBAR_CMD_SET_PROGRAM command uses an 8-bit size field for its payload length, but the protocol-negotiated `max_request` may exceed the maximum value an 8-bit integer can represent. When this occurs, large payloads (e.g., >255 bytes) integer wrap the 8-bit size variable when assigning `param->set_program_ex.size`, causing truncation and parse failures downstream in the EC firmware stack. Clamp `max_size` to the maximum value the structural size field can support. Fixes: 9600b8bdbfe4 ("platform/chrome: lightbar: Add support for large sequence") Signed-off-by: Alexis Savery <asavery@google.com> Link: https://lore.kernel.org/r/20260730204240.2227178-1-asavery@google.com Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-29 06:48:48 +0000