Re: [PATCH v4] platform/x86: alienware-wmi-base: Transition to new WMI API

[Armin Wolf]

Am 29.04.26 um 15:23 schrieb Kurt Borja:

> On Tue Apr 28, 2026 at 2:27 PM -05, Armin Wolf wrote:
> > Am 28.04.26 um 18:37 schrieb Kurt Borja:
> >
> > > Transition to the new wmi_buffer based WMI API.
> > >
> > > Signed-off-by: Kurt Borja <kuurtb@xxxxxxxxx>
> > > ---
> > > v4:
> > >     - Rebase to use the new wmidev_invoke_method() with size check
> > >
> > > v3: https://patch.msgid.link/20260331-aw-new-api-v3-1-ef03b94529d8@xxxxxxxxx
> > >     - Use __free() instead of manual cleanup.
> > >     - Include <linux/types.h>
> > >
> > > v2: https://patch.msgid.link/20260331-aw-new-api-v2-1-3b0d33bf8d22@xxxxxxxxx
> > >     - Cast wmi_buffer data to __le32 and then use le32_to_cpu() before
> > >       returning
> > >
> > > v1: https://patch.msgid.link/20260330-aw-new-api-v1-1-95910bfa1b38@xxxxxxxxx
> > > ---
> > >    drivers/platform/x86/dell/alienware-wmi-base.c | 31 ++++++++++++++++----------
> > >    1 file changed, 19 insertions(+), 12 deletions(-)
> > >
> > > diff --git a/drivers/platform/x86/dell/alienware-wmi-base.c b/drivers/platform/x86/dell/alienware-wmi-base.c
> > > index 64562b92314f..21d3acfbd73d 100644
> > > --- a/drivers/platform/x86/dell/alienware-wmi-base.c
> > > +++ b/drivers/platform/x86/dell/alienware-wmi-base.c
> > > @@ -12,8 +12,13 @@
> > >    #include <linux/cleanup.h>
> > >    #include <linux/module.h>
> > >    #include <linux/platform_device.h>
> > > +#include <linux/slab.h>
> > > +#include <linux/types.h>
> > >    #include <linux/dmi.h>
> > >    #include <linux/leds.h>
> > > +
> > > +#include <asm/byteorder.h>
> > > +
> > >    #include "alienware-wmi.h"
> > >    
> > >    MODULE_AUTHOR("Mario Limonciello <mario.limonciello@xxxxxxxxxxx>");
> > > @@ -150,21 +155,23 @@ u8 alienware_interface;
> > >    int alienware_wmi_command(struct wmi_device *wdev, u32 method_id,
> > >    			  void *in_args, size_t in_size, u32 *out_data)
> > >    {
> > > -	struct acpi_buffer out = {ACPI_ALLOCATE_BUFFER, NULL};
> > > -	struct acpi_buffer in = {in_size, in_args};
> > > -	acpi_status ret;
> > > +	struct wmi_buffer out, in = {
> > > +		.data = in_args,
> > > +		.length = in_size,
> > > +	};
> > > +	int ret;
> > >    
> > > -	ret = wmidev_evaluate_method(wdev, 0, method_id, &in, out_data ? &out : NULL);
> > > -	if (ACPI_FAILURE(ret))
> > > -		return -EIO;
> > > -
> > > -	union acpi_object *obj __free(kfree) = out.pointer;
> > > +	if (out_data)
> > > +		ret = wmidev_invoke_method(wdev, 0, method_id, &in, &out,
> > > +					   sizeof(*out_data));
> > > +	else
> > > +		ret = wmidev_invoke_method(wdev, 0, method_id, &in, NULL, 0);
> > > +	if (ret)
> > > +		return ret;
> > >    
> > >    	if (out_data) {
> > > -		if (obj && obj->type == ACPI_TYPE_INTEGER)
> > > -			*out_data = (u32)obj->integer.value;
> > > -		else
> > > -			return -ENOMSG;
> > > +		__le32 *data __free(kfree) = out.data;
> > > +		*out_data = le32_to_cpu(*data);
> > >    	}
> > Hi,
> >
> > calling wmidev_invoke_method() with a NULL output buffer will likely lead to crashes. This happens
> > because wmidev_invoke_method() demands that a valid pointer to a output buffer is provided by the
> > caller. I suggest that you use wmidev_invoke_procedure() instead:
> >
> > 	__le32 *data __free(kfree) = NULL;
> >
> > 	if (!out_data)
> > 		return wmidev_invoke_procedure(wdev, 0, method_id, &in);
> >
> > 	ret = wmidev_invoke_method(wdev, 0, method_id, &in, &out, sizeof(*data));
> > 	if (ret < 0)
> > 		return ret;
> >
> > 	result = out.data
> > 	...
> Hi Armin,
>
> You're right, I thought the only difference between _procedure and
> _method was the size check.
>
> Also, Sashiko [1] reported that out.data might be ZERO_SIZE_PTR even if
> wmidev_invoke_method() succeeds. I thought it was a false positive but I
> looked further and it was actually a bug. I submitted a fix for this.

Thank you, i will take a look at it immediately.

Thanks,
Armin Wolf

> [1] https://sashiko.dev/#/patchset/20260428-aw-new-api-v4-1-d2c06241d7ad%40gmail.com