16 Commits

Author SHA1 Message Date
Kurt Borja
d3b7a868f1 platform/wmi: Fix unchecked min_size in wmidev_invoke_method()
After calling wmidev_evaluate_method(), if the ACPI core does not return
an out object, then wmidev_invoke_method() bypasses the min_size check
and returns 0. Add a check for min_size if there is not an out object.

Fixes: 1aeded2f55 ("platform/wmi: Extend wmidev_query_block() to reject undersized data")
Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de
Signed-off-by: Kurt Borja <kuurtb@gmail.com>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260429-invoke-fix-v1-1-ce938eb80cd3@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-30 15:33:32 +03:00
Linus Torvalds
da6b5aae84 Merge tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver updates from Ilpo Järvinen:
 "asus-wmi:
   - Retain battery charge threshold during boot which avoids
     unsolicited change to 100%. Return -ENODATA when the limit
     is not yet known
   - Improve screenpad power/brightness handling consistency
   - Fix screenpad brightness range

  barco-p50-gpio:
   - Normalize gpio_get return values

  bitland-mifs-wmi:
   - Add driver for Bitland laptops (supports platform profile,
     hwmon, kbd backlight, gpu mode, hotkeys, and fan boost)

  dell_rbu:
   - Fix using uninitialized value in sysfs write function

  dell-wmi-sysman:
   - Respect destination length when constructing enum strings

  hp-wmi:
   - Propagate fan setting apply failures and log an error
   - Fix sysfs write vs work handler cancel_delayed_work_sync() deadlock
   - Correct keepalive schedule_delayed_work() to mod_delayed_work()
   - Fix u8 underflows in GPU delta calculation
   - Use mutex to protect fan pwm/mode
   - Ignore kbd backlight and FnLock key events that are handled by FW
   - Fix fan table parsing (use correct field)
   - Add support for Omen 14-fb0xxx, 16-n0xxx, 16-wf1xxx, and
     Omen MAX 16-ak0xxxx

  input: trackpoint & thinkpad_acpi:
   - Enable doubletap by default and add sysfs enable/disable

  int3472:
   - Add support for GPIO type 0x02 (IR flood LED)

  intel-speed-select: (updated to v1.26)
   - Avoid using current base frequency as maximum
   - Fix CPU extended family ID decoding
   - Fix exit code
   - Improve error reporting

  intel/vsec:
   - Refactor to support ACPI-enumerated PMT endpoints.

  pcengines-apuv2:
   - Attach software node to the gpiochip

  uniwill:
   - Refactor hwmon to smaller parts to accomodate HW diversity
   - Support USB-C power/performance priority switch through sysfs
   - Add another XMG Fusion 15 (L19) DMI vendor
   - Enable fine-grained features to device lineup mapping

  wmi:
   - Perform output size check within WMI core to allow simpler WMI
     drivers

  misc:
   - acpi_driver -> platform driver conversions (a large number of
     changes from Rafael J. Wysocki)
   - cleanups / refactoring / improvements"

* tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (106 commits)
  platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77)
  platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44)
  platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87)
  platform/x86: hp-wmi: fix fan table parsing
  platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) support
  platform/wmi: Replace .no_notify_data with .min_event_size
  platform/wmi: Extend wmidev_query_block() to reject undersized data
  platform/wmi: Extend wmidev_invoke_method() to reject undersized data
  platform/wmi: Prepare to reject undersized unmarshalling results
  platform/wmi: Convert drivers to use wmidev_invoke_procedure()
  platform/wmi: Add wmidev_invoke_procedure()
  platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED)
  platform/x86: int3472: Parameterize LED con_id in registration
  platform/x86: int3472: Rename pled to led in LED registration code
  platform/x86: int3472: Use local variable for LED struct access
  platform/x86: thinkpad_acpi: remove obsolete TODO comment
  platform/x86: dell-wmi-sysman: bound enumeration string aggregation
  platform/x86: hp-wmi: Ignore backlight and FnLock events
  platform/x86: uniwill-laptop: Fix signedness bug
  platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
  ...
2026-04-20 12:02:24 -07:00
Armin Wolf
2e2a39149f platform/wmi: Replace .no_notify_data with .min_event_size
WMI drivers using the buffer-based WMI API are expected to reject
undersized event payloads. Extend the WMI driver core to allow
such drivers to specify their minimum supported event payload size.
Also remove the now redundant .no_notify_data field.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-7-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13 14:11:27 +03:00
Armin Wolf
1aeded2f55 platform/wmi: Extend wmidev_query_block() to reject undersized data
WMI drivers using the buffer-based WMI API are expected to reject
undersized query results. Extend wmidev_query_block() to enable
the WMI driver core to perform this size check internally.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-6-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13 14:11:25 +03:00
Armin Wolf
96b1b053e1 platform/wmi: Extend wmidev_invoke_method() to reject undersized data
WMI drivers using the buffer-based WMI API are expected to reject
undersized method return values. Extend wmidev_invoke_method() to
enable the WMI driver core to perform this size check internally.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13 14:11:24 +03:00
Armin Wolf
204b52fadf platform/wmi: Prepare to reject undersized unmarshalling results
Driver using the buffer-based WMI API usually reject buffers resulting
from WMI method calls or block queries if they contain not enough data.
Prepare the WMI core for assisting in this by automatically rejecting
undersized unmarshalling results.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13 14:11:22 +03:00
Armin Wolf
7e2d964f41 platform/wmi: Add wmidev_invoke_procedure()
Some WMI methods return no values, so the whole postprocessing
of the result data is not needed for them. Add a special function
for calling such WMI methods to prepare for future changes of
the main wmidev_invoke_method() function.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260406203237.2970-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-13 14:11:18 +03:00
Danilo Krummrich
8a700b1fc9 platform/wmi: use generic driver_override infrastructure
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]

Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
Fixes: 12046f8c77 ("platform/x86: wmi: Add driver_override support")
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260324005919.2408620-7-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-04 00:45:14 +02:00
Linus Torvalds
bf4afc53b7 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21 17:09:51 -08:00
Kees Cook
69050f8d6d treewide: Replace kmalloc with kmalloc_obj for non-scalar types
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-21 01:02:28 -08:00
Armin Wolf
5d4ae0bffb platform/wmi: string-kunit: Add missing oversized string test case
When compiling the WMI string kunit tests using llvm, the compiler
will issue a warning about "oversized_test_utf8_string" being unused.
This happens because the test case that was supposed to use said
variable was accidentally omitted when adding the kunit tests.

Fix this by adding the aforementioned test case.

Fixes: 0e1a8143e7 ("platform/wmi: Add kunit test for the string conversion code")
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/platform-driver-x86/20260122234521.GA413183@ax162/
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260123211537.4448-1-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26 16:03:18 +02:00
Armin Wolf
0e1a8143e7 platform/wmi: Add kunit test for the string conversion code
The string conversion frunctions provided by the WMI driver core
have no dependencies on the remaining WMI API, making them suitable
for unit tests.

Implement such a unit test using kunit. Those unit tests verify that
converting between WMI strings and UTF8 strings works as expected.
They also verify that edge cases are handled correctly.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260116204116.4030-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-20 15:47:52 +02:00
Armin Wolf
b990a06f7e platform/wmi: Add helper functions for WMI string conversions
WMI strings are encoded using UTF16-LE characters, forcing WMI drivers
to manually convert them to/from standard UTF8 strings. Add a two
helper functions for those tasks.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260116204116.4030-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-20 15:47:51 +02:00
Armin Wolf
29dfba69c3 platform/wmi: Add kunit test for the marshalling code
The marshalling code used by the WMI driver core is implemented as
a separate component, suitable for unit tests.

Implmented such a unit test using KUnit. Those unit tests verify that
ACPI objects are correctly converted into WMI buffers and that WMI
strings are correctly converted into ACPI strings. They also verify
that invalid ACPI data (like nested packages) is rejected.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260116204116.4030-3-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-20 15:47:49 +02:00
Armin Wolf
015b70a6ae platform/wmi: Introduce marshalling support
The Windows WMI-ACPI driver likely uses wmilib [1] to interact with
the WMI service in userspace. Said library uses plain byte buffers
for exchanging data, so the WMI-ACPI driver has to convert between
those byte buffers and ACPI objects returned by the ACPI firmware.

The format of the byte buffer is publicly documented [2], and after
some reverse eingineering of the WMI-ACPI driver using a set of custom
ACPI tables, the following conversion rules have been discovered:

- ACPI integers are always converted into a uint32
- ACPI strings are converted into special WMI strings
- ACPI buffers are copied as-is
- ACPI packages are unpacked

Extend the ACPI-WMI driver to also perform this kind of marshalling
for WMI data blocks, methods and events. Doing so gives us a number
of benefits:

- WMI drivers are not restricted to a fixed set of supported ACPI data
  types anymore, see dell-wmi-aio (integer vs buffer) and
  hp-wmi-sensors (string vs buffer)

- correct marshalling of WMI strings when data blocks are marked
  as requiring ACPI strings instead of ACPI buffers

- development of WMI drivers without having to understand ACPI

This eventually should result in better compatibility with some
ACPI firmware implementations and in simpler WMI drivers. There are
however some differences between the original Windows driver and
the ACPI-WMI driver when it comes to ACPI object conversions:

- the Windows driver copies internal _ACPI_METHOD_ARGUMENT_V1 data
  structures into the output buffer when encountering nested ACPI
  packages. This is very likely an error inside the driver itself, so
  we do not support nested ACPI packages.

- when converting WMI strings (UTF-16LE) into ACPI strings (ASCII),
  the Windows driver replaces non-ascii characters (ä -> a, & -> ?)
  instead of returning an error. This behavior is not documented
  anywhere and might lead to severe errors in some cases (like
  setting BIOS passwords over WMI), so we simply return an error.

As the current bus-based WMI API is based on ACPI buffers, a new
API is necessary. The legacy GUID-based WMI API is not extended to
support marshalling, as WMI drivers using said API are expected to
move to the bus-based WMI API in the future.

[1] https://learn.microsoft.com/de-de/windows-hardware/drivers/ddi/wmilib/
[2] https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/
    driver-defined-wmi-data-items

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260116204116.4030-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-20 15:47:47 +02:00
Armin Wolf
e2c1b56f3d platform/x86: wmi: Move WMI core code into a separate directory
Move the WMI core code into a separate directory to prepare for
future additions to the WMI driver. Also update the description
of the Kconfig entry to better fit with the other subsystem
Kconfig entries.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20251111131125.3379-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-11-18 11:18:11 +02:00