[PATCH 0/2] platform/x86/amd/hsmp: Validate num_args and Report raw SMU mailbox status
From: Muralidhara M K
Date: Sat Oct 17 2026 - 13:03:42 EST
This series adds a __u32 smu_response field to struct hsmp_message and
struct hsmp_telemetry_data, so userspace can inspect the raw SMU
mailbox status instead of only the translated errno.
Patch 1 is a preparatory fix: hsmp_ioctl_msg()'s fd-mode gate calls
is_get_msg(), which reads msg.args[0], before checking that num_args
matches the message descriptor, so a request with no args can still
reach that read. Validate num_args first.
Patch 2 adds smu_response to both structs, set from the polled SMU
mailbox status register, and has hsmp_ioctl_msg() always copy the
message struct back to userspace, even on failure, so smu_response is
visible on every call. It also fixes a related copy_to_user()
error-check bug in hsmp_ioctl_get_telemetry() uncovered along the way.
Both structs grow under #pragma pack(4) (44->48 and 16->20 bytes),
changing the encoded HSMP_IOCTL_CMD and HSMP_IOCTL_GET_TELEMETRY_DATA
command numbers; existing userspace needs to rebuild against the
updated header.
Each patch builds individually and is clean under checkpatch.pl
--strict.
Muralidhara M K (2):
platform/x86/amd/hsmp: Validate num_args before the fd-mode gate in
hsmp_ioctl_msg()
platform/x86/amd/hsmp: Report raw SMU mailbox status via smu_response
Documentation/arch/x86/amd_hsmp.rst | 28 +++++--
arch/x86/include/uapi/asm/amd_hsmp.h | 35 ++++++---
drivers/platform/x86/amd/hsmp/hsmp.c | 111 +++++++++++++++++++--------
3 files changed, 123 insertions(+), 51 deletions(-)
base-commit: 03f79b70cfa59c76751bc176e6a85a5a67c91801
--
2.34.1