From e4ee0bb077cd7d70207647a0106f6ea6a74c2636 Mon Sep 17 00:00:00 2001 From: Jameson Thies Date: Tue, 7 Oct 2025 00:40:43 +0000 Subject: [PATCH 1/4] platform/chrome: cros_usbpd_notify: defer probe when parent EC driver isn't ready The cros-usbpd-notify-acpi probe currently does not exit when it fails to get a pointer to the ChromeOS EC device. It is expected behavior on older devices, where GOOG0004 is not a parent of GOOG0003. Update the cros-usbpd-notify-acpi probe to check for a GOOG0004 parent fwnode. If the device has correct device hierarchy and fails to get an EC device pointer, defer the probe function. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Link: https://lore.kernel.org/r/20251007004043.4109957-1-jthies@google.com Signed-off-by: Tzung-Bi Shih --- drivers/platform/chrome/cros_usbpd_notify.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/platform/chrome/cros_usbpd_notify.c b/drivers/platform/chrome/cros_usbpd_notify.c index 313d2bcd577b..c90174360004 100644 --- a/drivers/platform/chrome/cros_usbpd_notify.c +++ b/drivers/platform/chrome/cros_usbpd_notify.c @@ -6,6 +6,7 @@ */ #include +#include #include #include #include @@ -15,6 +16,7 @@ #define DRV_NAME "cros-usbpd-notify" #define DRV_NAME_PLAT_ACPI "cros-usbpd-notify-acpi" #define ACPI_DRV_NAME "GOOG0003" +#define CREC_DRV_NAME "GOOG0004" static BLOCKING_NOTIFIER_HEAD(cros_usbpd_notifier_list); @@ -98,8 +100,9 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev) { struct cros_usbpd_notify_data *pdnotify; struct device *dev = &pdev->dev; - struct acpi_device *adev; + struct acpi_device *adev, *parent_adev; struct cros_ec_device *ec_dev; + struct fwnode_handle *parent_fwnode; acpi_status status; adev = ACPI_COMPANION(dev); @@ -114,8 +117,18 @@ static int cros_usbpd_notify_probe_acpi(struct platform_device *pdev) /* * We continue even for older devices which don't have the * correct device heirarchy, namely, GOOG0003 is a child - * of GOOG0004. + * of GOOG0004. If GOOG0003 is a child of GOOG0004 and we + * can't get a pointer to the Chrome EC device, defer the + * probe function. */ + parent_fwnode = fwnode_get_parent(dev->fwnode); + if (parent_fwnode) { + parent_adev = to_acpi_device_node(parent_fwnode); + if (parent_adev && + acpi_dev_hid_match(parent_adev, CREC_DRV_NAME)) { + return -EPROBE_DEFER; + } + } dev_warn(dev, "Couldn't get Chrome EC device pointer.\n"); } From c862381bd03ad4d999e0f1b3f8d1119ed7aa2e96 Mon Sep 17 00:00:00 2001 From: Brady Norander Date: Thu, 30 Oct 2025 15:59:11 -0400 Subject: [PATCH 2/4] platform/chrome: cros_ec_lightbar: Check if ec supports suspend commands The Chromebook Pixel 2013 (Link)'s ec does not support the lightbar manual suspend commands. As a result, attempting to suspend the device fails and prints the following error: cros-ec-lightbar cros-ec-lightbar.3.auto: PM: dpm_run_callback(): platform_pm_suspend returns -22 cros-ec-lightbar cros-ec-lightbar.3.auto: PM: failed to suspend: error -22 PM: Some devices failed to suspend, or early wake event detected Check the return value of lb_manual_suspend_ctrl in cros_ec_lightbar_probe and disable manual suspend control if -EINVAL is returned. Signed-off-by: Brady Norander Reviewed-by: Benson Leung Link: https://lore.kernel.org/r/20251030195910.8625-2-bradynorander@gmail.com Signed-off-by: Tzung-Bi Shih --- drivers/platform/chrome/cros_ec_lightbar.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c index 87634f6921b7..8352e9732791 100644 --- a/drivers/platform/chrome/cros_ec_lightbar.c +++ b/drivers/platform/chrome/cros_ec_lightbar.c @@ -30,6 +30,13 @@ static unsigned long lb_interval_jiffies = 50 * HZ / 1000; */ static bool userspace_control; +/* + * Whether or not the lightbar supports the manual suspend commands. + * The Pixel 2013 (Link) does not while all other devices with a + * lightbar do. + */ +static bool has_manual_suspend; + static ssize_t interval_msec_show(struct device *dev, struct device_attribute *attr, char *buf) { @@ -550,7 +557,7 @@ static int cros_ec_lightbar_probe(struct platform_device *pd) return -ENODEV; /* Take control of the lightbar from the EC. */ - lb_manual_suspend_ctrl(ec_dev, 1); + has_manual_suspend = (lb_manual_suspend_ctrl(ec_dev, 1) != -EINVAL); ret = sysfs_create_group(&ec_dev->class_dev.kobj, &cros_ec_lightbar_attr_group); @@ -569,14 +576,15 @@ static void cros_ec_lightbar_remove(struct platform_device *pd) &cros_ec_lightbar_attr_group); /* Let the EC take over the lightbar again. */ - lb_manual_suspend_ctrl(ec_dev, 0); + if (has_manual_suspend) + lb_manual_suspend_ctrl(ec_dev, 0); } static int __maybe_unused cros_ec_lightbar_resume(struct device *dev) { struct cros_ec_dev *ec_dev = dev_get_drvdata(dev->parent); - if (userspace_control) + if (userspace_control || !has_manual_suspend) return 0; return lb_send_empty_cmd(ec_dev, LIGHTBAR_CMD_RESUME); @@ -586,7 +594,7 @@ static int __maybe_unused cros_ec_lightbar_suspend(struct device *dev) { struct cros_ec_dev *ec_dev = dev_get_drvdata(dev->parent); - if (userspace_control) + if (userspace_control || !has_manual_suspend) return 0; return lb_send_empty_cmd(ec_dev, LIGHTBAR_CMD_SUSPEND); From 944edca81e7aea15f83cf9a13a6ab67f711e8abd Mon Sep 17 00:00:00 2001 From: Tzung-Bi Shih Date: Fri, 31 Oct 2025 03:39:00 +0000 Subject: [PATCH 3/4] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread `cros_ec_console_log_work` is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device in .remove() which should shutdown sub-devices synchronously. Fix it. Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih --- drivers/platform/chrome/cros_ec_ishtp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c index 4e74e702c5a2..3766cef81fe8 100644 --- a/drivers/platform/chrome/cros_ec_ishtp.c +++ b/drivers/platform/chrome/cros_ec_ishtp.c @@ -667,6 +667,7 @@ static void cros_ec_ishtp_remove(struct ishtp_cl_device *cl_device) cancel_work_sync(&client_data->work_ishtp_reset); cancel_work_sync(&client_data->work_ec_evt); + cros_ec_unregister(client_data->ec_dev); cros_ish_deinit(cros_ish_cl); ishtp_put_device(cl_device); } From 52075d2c7595cfd6c1ce211a9cd138a9b067c448 Mon Sep 17 00:00:00 2001 From: Diogo Ivo Date: Wed, 12 Nov 2025 16:00:12 +0000 Subject: [PATCH 4/4] platform/chrome: sensorhub: Support devices without FIFO_INT_ENABLE Some devices (such as Smaug) report having MOTION_SENSE_FIFO but do not support controlling the behaviour of the FIFO interrupt via the FIFO_INT_ENABLE command and in these cases the interrupt is always enabled. However, currently the code assumes that if MOTION_SENSE_FIFO is supported then so is FIFO_INT_ENABLE, and when it tries to enable the interrupt via this command and an unsupported device reports a failure it then propagates this into failing the sensors probe. Interpret the return value -EINVAL as a device where FIFO_INT_ENABLE is not present and the interrupt is always enabled. Signed-off-by: Diogo Ivo Link: https://lore.kernel.org/r/20251112-diogo-smaug_ec_sensorhub-v1-1-f71d4e9eb9d4@tecnico.ulisboa.pt Signed-off-by: Tzung-Bi Shih --- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c index 1205219515d6..a10579144c34 100644 --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c @@ -129,6 +129,17 @@ int cros_ec_sensorhub_ring_fifo_enable(struct cros_ec_sensorhub *sensorhub, /* We expect to receive a payload of 4 bytes, ignore. */ if (ret > 0) ret = 0; + /* + * Some platforms (such as Smaug) don't support the FIFO_INT_ENABLE + * command and the interrupt is always enabled. In the case, it + * returns -EINVAL. + * + * N.B: there is no danger of -EINVAL meaning any other invalid + * parameter since fifo_int_enable.enable is a bool and can never + * be in an invalid range. + */ + else if (ret == -EINVAL) + ret = 0; return ret; }