[RFC PATCH 0/2] Monitor Yoga Slim 7x EC sensors without taking over cooling

[RFC PATCH 0/2] Monitor Yoga Slim 7x EC sensors without taking over cooling

[Birk Skyum]

The Yoga Slim 7x firmware tested here (EC 0.99.0, BIOS NHCN62WW) returns
00 00 00 to command 0x42. The upstream driver correctly rejects that
malformed thermal capability response. Its legacy fan RPM query (0x22,
fan ID 1) and thermistor query (0x29) work, and the firmware ramps the fan
automatically under CPU load.

This series adds a Lenovo-specific, read-only path to the existing driver
and KUnit tests using a simulated I2C adapter. It does not replace the
strict reference-board response validation, guess a writable fan count,
or include calibration, LUT programming or temperature reporting.

This builds on Daniel J Blueman's pending binding and board patches [1].
They remain separate prerequisites, with Daniel's authorship unchanged.
The sensor transactions are documented in the public Yoga DSDT and Maya
Matuszczyk's protocol notes; Anvesh Jain P's pending fan-profile series
also implements the RPM query [2].

Testing on the Yoga with the EC node enabled and its existing 7.2 kernel:
- W=1 external-module build.
- Three bind/read/unload cycles; read-only fan1_input and temp1_input.
- Bounded CPU load: fan rose from 0 to approximately 2800 RPM, with a
  maximum SoC reading of 55.4 C. Original profile 0x15 was unchanged.
- Previous monitor restored after testing; boot files unchanged.

On the stated mainline base, an arm64 KUnit kernel booted in QEMU passes
all seven tests. These cover sensor decoding, error handling, compatible
selection, probe, read-only attributes and no-write PM/remove callbacks.
The QEMU results validate code paths, not Yoga suspend behavior.

Two design questions for this RFC:
- Is this read-only match-data path the preferred way to accommodate
  the Lenovo firmware alongside the reference-board work?
- Should the pending Lenovo binding omit the qcom,hamoa-crd-ec fallback,
  given that this firmware cannot satisfy the reference driver's probe?

EC standby notifications and desktop power-profile integration are not
implemented or claimed by this series. Those need separate validation.

[1] https://lore.kernel.org/all/20260526112409.66325-1-daniel@quora.org/
[2] https://lkml.iu.edu/hypermail/linux/kernel/2607.3/08806.html

Birk Skyum (2):
  platform: arm64: qcom-hamoa-ec: monitor Slim 7x legacy sensors
  platform: arm64: qcom-hamoa-ec: test sensor and variant handling

 Documentation/hwmon/index.rst               |   1 +
 Documentation/hwmon/qcom-ec.rst             |  40 +++
 MAINTAINERS                                 |   2 +
 drivers/platform/arm64/Kconfig              |  16 +-
 drivers/platform/arm64/qcom-hamoa-ec-test.c | 294 ++++++++++++++++++++
 drivers/platform/arm64/qcom-hamoa-ec.c      | 157 ++++++++++-
 6 files changed, 505 insertions(+), 5 deletions(-)
 create mode 100644 Documentation/hwmon/qcom-ec.rst
 create mode 100644 drivers/platform/arm64/qcom-hamoa-ec-test.c


base-commit: 28924df2a08f440c73991b83028032c901de2ae4
-- 
2.53.0

[RFC PATCH 1/2] platform: arm64: qcom-hamoa-ec: monitor Slim 7x legacy sensors

[Birk Skyum]

The Yoga Slim 7x EC returns an all-zero response to the reference-board
thermal capability command. Probe fails even though its legacy RPM and
thermistor queries work and firmware controls the fan automatically.

Select a read-only path for the Lenovo compatible. Expose its first RPM
channel and thermistor through hwmon, validating the transfer length and
RPM payload count and treating the thermistor's 0xff sentinel as ENODATA.
Do not enable SCI, register manual cooling controls or send standby
commands on this path. Keep the reference-board behavior and strict
capability validation unchanged.

The transactions are documented by the Yoga's FC22 and FC29/TZ39 DSDT
methods and Maya Matuszczyk's EC protocol notes. Anvesh Jain P's pending
fan-profile series also documents the RPM query. This change does not
include its calibration, LUT programming or temperature reporting.

Link: https://github.com/aarch64-laptops/build/blob/2e58842f5fa2f87771c2df017ae4d8c65225ef10/misc/lenovo-yoga-slim-7x/acpi/dsdt.dsl
Link: https://lkml.iu.edu/hypermail/linux/kernel/2607.3/08806.html
Signed-off-by: Birk Skyum <birk.skyum@pm.me>
---
 Documentation/hwmon/index.rst          |   1 +
 Documentation/hwmon/qcom-ec.rst        |  40 +++++++
 MAINTAINERS                            |   1 +
 drivers/platform/arm64/Kconfig         |   4 +-
 drivers/platform/arm64/qcom-hamoa-ec.c | 153 ++++++++++++++++++++++++-
 5 files changed, 194 insertions(+), 5 deletions(-)
 create mode 100644 Documentation/hwmon/qcom-ec.rst

diff --git a/Documentation/hwmon/index.rst b/Documentation/hwmon/index.rst
index 9955a5254..7ce23ea5a 100644
--- a/Documentation/hwmon/index.rst
+++ b/Documentation/hwmon/index.rst
@@ -233,6 +233,7 @@ Hardware Monitoring Kernel Drivers
    pxe1610
    pwm-fan
    q54sj108a2
+   qcom-ec
    qnap-mcu-hwmon
    raspberrypi-hwmon
    sbrmi
diff --git a/Documentation/hwmon/qcom-ec.rst b/Documentation/hwmon/qcom-ec.rst
new file mode 100644
index 000000000..11f9f2347
--- /dev/null
+++ b/Documentation/hwmon/qcom-ec.rst
@@ -0,0 +1,40 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+Kernel driver qcom-hamoa-ec
+==========================
+
+Supported systems:
+
+  * Lenovo Yoga Slim 7x (14Q8X9)
+
+    Prefix: 'qcom_ec'
+
+    I2C address: 0x76, instantiated from the device tree. No scanning.
+
+Description
+-----------
+
+The Yoga Slim 7x embedded controller provides a fan speed channel and a
+thermistor through a legacy interface. It does not provide the thermal
+capability response used by the Qualcomm reference-board interface.
+
+On this system the driver only reads sensors. Cooling remains under firmware
+control, including when the driver is unloaded. The driver does not change
+fan curves, fan profiles, PWM settings, SCI events or EC standby state.
+The exposed RPM channel does not establish the number of physical fans.
+
+The hwmon interface is selected by the ``lenovo,yoga-slim7x-ec`` compatible.
+It is not exposed on Qualcomm reference boards by this driver.
+
+Sysfs attributes
+----------------
+
+All attributes below are read-only.
+
+=============== ======================================================
+fan1_input      Fan speed in RPM. Zero is valid when the fan is stopped.
+temp1_input     EC thermistor temperature in millidegrees Celsius.
+=============== ======================================================
+
+An unavailable thermistor reading returns ``ENODATA``. A malformed fan
+response or an incomplete bus transfer returns an error, not a zero speed.
diff --git a/MAINTAINERS b/MAINTAINERS
index 6215fcb07..8518a97b4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22441,6 +22441,7 @@ M:	Sibi Sankar <sibi.sankar@oss.qualcomm.com>
 L:	linux-arm-msm@vger.kernel.org
 S:	Maintained
 F:	Documentation/devicetree/bindings/embedded-controller/qcom,hamoa-crd-ec.yaml
+F:	Documentation/hwmon/qcom-ec.rst
 F:	drivers/platform/arm64/qcom-hamoa-ec.c
 
 QUALCOMM HEXAGON ARCHITECTURE
diff --git a/drivers/platform/arm64/Kconfig b/drivers/platform/arm64/Kconfig
index e32e01b2a..4f338c715 100644
--- a/drivers/platform/arm64/Kconfig
+++ b/drivers/platform/arm64/Kconfig
@@ -94,6 +94,7 @@ config EC_QCOM_HAMOA
 	tristate "Embedded Controller driver for Qualcomm Hamoa/Glymur reference devices"
 	depends on ARCH_QCOM || COMPILE_TEST
 	depends on I2C
+	depends on HWMON
 	depends on THERMAL || THERMAL=n
 	help
 	  Say M or Y here to enable the Embedded Controller driver for Qualcomm
@@ -101,6 +102,7 @@ config EC_QCOM_HAMOA
 	  control, temperature sensors, access to EC state changes and supports
 	  reporting suspend entry/exit to the EC.
 
-	  This driver currently supports Hamoa/Purwa/Glymur reference devices.
+	  This driver supports Hamoa/Purwa/Glymur reference devices and read-only
+	  fan speed and temperature monitoring on the Lenovo Yoga Slim 7x.
 
 endif # ARM64_PLATFORM_DEVICES
diff --git a/drivers/platform/arm64/qcom-hamoa-ec.c b/drivers/platform/arm64/qcom-hamoa-ec.c
index 4d2ad042a..3a4ca8a0d 100644
--- a/drivers/platform/arm64/qcom-hamoa-ec.c
+++ b/drivers/platform/arm64/qcom-hamoa-ec.c
@@ -9,6 +9,7 @@
 #include <linux/device.h>
 #include <linux/dev_printk.h>
 #include <linux/err.h>
+#include <linux/hwmon.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
@@ -16,10 +17,13 @@
 #include <linux/pm.h>
 #include <linux/slab.h>
 #include <linux/thermal.h>
+#include <linux/unaligned.h>
 
 #define EC_SCI_EVT_READ_CMD	0x05
 #define EC_FW_VERSION_CMD	0x0e
+#define EC_FAN_RPM_QUERY_CMD	0x22
 #define EC_MODERN_STANDBY_CMD	0x23
+#define EC_THERMISTOR1_CMD	0x29
 #define EC_FAN_DBG_CONTROL_CMD	0x30
 #define EC_SCI_EVT_CONTROL_CMD	0x35
 #define EC_THERMAL_CAP_CMD	0x42
@@ -76,13 +80,126 @@ struct qcom_ec_cooling_dev {
 	u8 state;
 };
 
+struct qcom_ec_variant {
+	bool monitor_only;
+};
+
 struct qcom_ec {
+	const struct qcom_ec_variant *variant;
 	struct qcom_ec_cooling_dev *ec_cdev;
 	struct qcom_ec_thermal_cap thermal_cap;
 	struct qcom_ec_version version;
 	struct i2c_client *client;
 };
 
+/* FC22 in the Slim 7x DSDT: command, fan ID; count, little-endian RPM. */
+static int qcom_ec_read_fan_rpm(struct qcom_ec *ec, long *val)
+{
+	struct i2c_client *client = ec->client;
+	u8 request[] = { EC_FAN_RPM_QUERY_CMD, 1 };
+	u8 response[3];
+	struct i2c_msg messages[] = {
+		{
+			.addr = client->addr,
+			.len = sizeof(request),
+			.buf = request,
+		}, {
+			.addr = client->addr,
+			.flags = I2C_M_RD,
+			.len = sizeof(response),
+			.buf = response,
+		},
+	};
+	int ret;
+
+	ret = i2c_transfer(client->adapter, messages, ARRAY_SIZE(messages));
+	if (ret < 0)
+		return ret;
+	if (ret != ARRAY_SIZE(messages))
+		return -EIO;
+	if (response[0] != sizeof(response) - 1)
+		return -EPROTO;
+
+	*val = get_unaligned_le16(&response[1]);
+
+	return 0;
+}
+
+static umode_t qcom_ec_hwmon_is_visible(const void *data, enum hwmon_sensor_types type,
+					u32 attr, int channel)
+{
+	if (channel)
+		return 0;
+	if ((type == hwmon_fan && attr == hwmon_fan_input) ||
+	    (type == hwmon_temp && attr == hwmon_temp_input))
+		return 0444;
+
+	return 0;
+}
+
+static int qcom_ec_hwmon_read(struct device *dev, enum hwmon_sensor_types type,
+			      u32 attr, int channel, long *val)
+{
+	struct qcom_ec *ec = dev_get_drvdata(dev);
+	int ret;
+
+	if (channel)
+		return -EOPNOTSUPP;
+
+	if (type == hwmon_fan && attr == hwmon_fan_input)
+		return qcom_ec_read_fan_rpm(ec, val);
+
+	if (type != hwmon_temp || attr != hwmon_temp_input)
+		return -EOPNOTSUPP;
+
+	/* FC29/TZ39 report degrees Celsius, or 0xff if unavailable. */
+	ret = i2c_smbus_read_byte_data(ec->client, EC_THERMISTOR1_CMD);
+	if (ret < 0)
+		return ret;
+	if (ret == 0xff)
+		return -ENODATA;
+
+	*val = ret * 1000;
+
+	return 0;
+}
+
+static const struct hwmon_ops qcom_ec_hwmon_ops = {
+	.is_visible = qcom_ec_hwmon_is_visible,
+	.read = qcom_ec_hwmon_read,
+};
+
+static const struct hwmon_channel_info * const qcom_ec_hwmon_info[] = {
+	HWMON_CHANNEL_INFO(fan, HWMON_F_INPUT),
+	HWMON_CHANNEL_INFO(temp, HWMON_T_INPUT),
+	NULL,
+};
+
+static const struct hwmon_chip_info qcom_ec_hwmon_chip_info = {
+	.ops = &qcom_ec_hwmon_ops,
+	.info = qcom_ec_hwmon_info,
+};
+
+static int qcom_ec_hwmon_probe(struct qcom_ec *ec)
+{
+	struct device *dev = &ec->client->dev;
+	struct device *hwmon;
+	long rpm;
+	int ret;
+
+	if (!i2c_check_functionality(ec->client->adapter,
+				     I2C_FUNC_I2C | I2C_FUNC_SMBUS_READ_BYTE_DATA))
+		return -EOPNOTSUPP;
+
+	ret = qcom_ec_read_fan_rpm(ec, &rpm);
+	if (ret)
+		return dev_err_probe(dev, ret, "Failed to read fan RPM\n");
+
+	hwmon = devm_hwmon_device_register_with_info(dev, "qcom_ec", ec,
+						     &qcom_ec_hwmon_chip_info, NULL);
+	return PTR_ERR_OR_ZERO(hwmon);
+}
+
 static int qcom_ec_read(struct qcom_ec *ec, u8 cmd, u8 resp_len, u8 *resp)
 {
 	int ret;
@@ -331,6 +448,10 @@ static const struct thermal_cooling_device_ops qcom_ec_thermal_ops = {
 static int qcom_ec_resume(struct device *dev)
 {
 	struct i2c_client *client = to_i2c_client(dev);
+	struct qcom_ec *ec = i2c_get_clientdata(client);
+
+	if (ec->variant->monitor_only)
+		return 0;
 
 	return i2c_smbus_write_byte_data(client, EC_MODERN_STANDBY_CMD,
 					 EC_MODERN_STANDBY_EXIT);
@@ -339,6 +460,10 @@ static int qcom_ec_resume(struct device *dev)
 static int qcom_ec_suspend(struct device *dev)
 {
 	struct i2c_client *client = to_i2c_client(dev);
+	struct qcom_ec *ec = i2c_get_clientdata(client);
+
+	if (ec->variant->monitor_only)
+		return 0;
 
 	return i2c_smbus_write_byte_data(client, EC_MODERN_STANDBY_CMD,
 					 EC_MODERN_STANDBY_ENTER);
@@ -356,14 +481,24 @@ static int qcom_ec_probe(struct i2c_client *client)
 		return -ENOMEM;
 
 	ec->client = client;
+	ec->variant = i2c_get_match_data(client);
+	if (!ec->variant)
+		return -ENODEV;
+	i2c_set_clientdata(client, ec);
+
+	/*
+	 * The Slim 7x does not implement the reference-board capability command.
+	 * Its firmware controls cooling autonomously. Only expose its legacy
+	 * sensors; do not enable SCI, fan debug control or standby notifications.
+	 */
+	if (ec->variant->monitor_only)
+		return qcom_ec_hwmon_probe(ec);
 
 	ret = devm_request_threaded_irq(dev, client->irq, NULL, qcom_ec_irq,
 					IRQF_ONESHOT, "qcom_ec", ec);
 	if (ret < 0)
 		return ret;
 
-	i2c_set_clientdata(client, ec);
-
 	ret = qcom_ec_read_fw_version(dev);
 	if (ret < 0)
 		return dev_err_probe(dev, ret, "Failed to read EC firmware version\n");
@@ -410,6 +545,9 @@ static void qcom_ec_remove(struct i2c_client *client)
 	struct device *dev = &client->dev;
 	int ret;
 
+	if (ec->variant->monitor_only)
+		return;
+
 	ret = qcom_ec_sci_evt_control(dev, false);
 	if (ret < 0)
 		dev_err(dev, "Failed to disable SCI events: %d\n", ret);
@@ -421,14 +559,21 @@ static void qcom_ec_remove(struct i2c_client *client)
 	}
 }
 
+static const struct qcom_ec_variant qcom_ec_reference = {};
+
+static const struct qcom_ec_variant qcom_ec_slim7x = {
+	.monitor_only = true,
+};
+
 static const struct of_device_id qcom_ec_of_match[] = {
-	{ .compatible = "qcom,hamoa-crd-ec" },
+	{ .compatible = "lenovo,yoga-slim7x-ec", .data = &qcom_ec_slim7x },
+	{ .compatible = "qcom,hamoa-crd-ec", .data = &qcom_ec_reference },
 	{}
 };
 MODULE_DEVICE_TABLE(of, qcom_ec_of_match);
 
 static const struct i2c_device_id qcom_ec_i2c_id_table[] = {
-	{ "qcom-hamoa-ec", },
+	{ "qcom-hamoa-ec", (kernel_ulong_t)&qcom_ec_reference },
 	{}
 };
 MODULE_DEVICE_TABLE(i2c, qcom_ec_i2c_id_table);
-- 
2.53.0

[RFC PATCH 2/2] platform: arm64: qcom-hamoa-ec: test sensor and variant handling

[Birk Skyum]

Exercise the sensor callbacks against a simulated I2C adapter. Check
little-endian RPM decoding, short transfers, malformed byte counts,
the unavailable-temperature sentinel and propagation of bus errors.

Check that the Lenovo compatible takes precedence over its reference-
board fallback, that its sensor attributes are read-only, and that its
probe and PM/remove callbacks do not issue control writes. Keep coverage
of the strict reference-board capability-response validation.

The tests use KUnit and never access a physical EC.

Signed-off-by: Birk Skyum <birk.skyum@pm.me>
---
 MAINTAINERS                                 |   1 +
 drivers/platform/arm64/Kconfig              |  12 +
 drivers/platform/arm64/qcom-hamoa-ec-test.c | 294 ++++++++++++++++++++
 drivers/platform/arm64/qcom-hamoa-ec.c      |   4 +
 4 files changed, 311 insertions(+)
 create mode 100644 drivers/platform/arm64/qcom-hamoa-ec-test.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 8518a97b4..58010a3e4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22442,6 +22442,7 @@ L:	linux-arm-msm@vger.kernel.org
 S:	Maintained
 F:	Documentation/devicetree/bindings/embedded-controller/qcom,hamoa-crd-ec.yaml
 F:	Documentation/hwmon/qcom-ec.rst
+F:	drivers/platform/arm64/qcom-hamoa-ec-test.c
 F:	drivers/platform/arm64/qcom-hamoa-ec.c
 
 QUALCOMM HEXAGON ARCHITECTURE
diff --git a/drivers/platform/arm64/Kconfig b/drivers/platform/arm64/Kconfig
index 4f338c715..d940973be 100644
--- a/drivers/platform/arm64/Kconfig
+++ b/drivers/platform/arm64/Kconfig
@@ -105,4 +105,16 @@ config EC_QCOM_HAMOA
 	  This driver supports Hamoa/Purwa/Glymur reference devices and read-only
 	  fan speed and temperature monitoring on the Lenovo Yoga Slim 7x.
 
+config EC_QCOM_HAMOA_KUNIT_TEST
+	bool "Tests for the Qualcomm EC driver" if !KUNIT_ALL_TESTS
+	depends on EC_QCOM_HAMOA && KUNIT && OF
+	depends on EC_QCOM_HAMOA=m || KUNIT=y
+	default KUNIT_ALL_TESTS
+	help
+	  Test the Qualcomm EC driver's sensor transactions and read-only
+	  callbacks using a simulated I2C adapter. No physical EC is accessed.
+	  Run these tests in a disposable test kernel, for example under QEMU.
+
+	  If unsure, say N.
+
 endif # ARM64_PLATFORM_DEVICES
diff --git a/drivers/platform/arm64/qcom-hamoa-ec-test.c b/drivers/platform/arm64/qcom-hamoa-ec-test.c
new file mode 100644
index 000000000..68868ef76
--- /dev/null
+++ b/drivers/platform/arm64/qcom-hamoa-ec-test.c
@@ -0,0 +1,294 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Included by qcom-hamoa-ec.c to test its private transport and callbacks. */
+
+#include <kunit/resource.h>
+#include <kunit/test.h>
+#include <linux/of.h>
+
+struct qcom_ec_test_context {
+	struct i2c_adapter adapter;
+	struct qcom_ec ec;
+	u32 functionality;
+	int transfer_result;
+	int byte_result;
+	u8 reply[4];
+	u8 block_length;
+	unsigned int transactions;
+	unsigned int writes;
+};
+
+static int qcom_ec_test_transfer(struct i2c_adapter *adapter,
+				 struct i2c_msg *messages, int count)
+{
+	struct qcom_ec_test_context *ctx = i2c_get_adapdata(adapter);
+
+	ctx->transactions++;
+	/* Only the RPM query's combined write/read transaction is allowed. */
+	if (count != 2 || messages[0].addr != 0x76 || messages[1].addr != 0x76 ||
+	    messages[0].flags || messages[1].flags != I2C_M_RD ||
+	    messages[0].len != 2 || messages[1].len != 3 ||
+	    messages[0].buf[0] != 0x22 || messages[0].buf[1] != 1) {
+		ctx->writes++;
+		return -EPROTO;
+	}
+
+	if (ctx->transfer_result == 2)
+		memcpy(messages[1].buf, ctx->reply, messages[1].len);
+
+	return ctx->transfer_result;
+}
+
+static s32 qcom_ec_test_smbus(struct i2c_adapter *adapter, u16 address,
+			      unsigned short flags, char read_write, u8 command,
+			      int size, union i2c_smbus_data *data)
+{
+	struct qcom_ec_test_context *ctx = i2c_get_adapdata(adapter);
+
+	ctx->transactions++;
+	if (read_write != I2C_SMBUS_READ) {
+		ctx->writes++;
+		return -EPROTO;
+	}
+	if (address != 0x76 || flags)
+		return -EPROTO;
+
+	if (command == 0x29 && size == I2C_SMBUS_BYTE_DATA) {
+		if (ctx->byte_result < 0)
+			return ctx->byte_result;
+		data->byte = ctx->byte_result;
+		return 0;
+	}
+
+	if ((command == 0x0e || command == 0x42) && size == I2C_SMBUS_I2C_BLOCK_DATA) {
+		data->block[0] = ctx->block_length;
+		memcpy(&data->block[1], ctx->reply, ctx->block_length);
+		return 0;
+	}
+
+	return -EPROTO;
+}
+
+static u32 qcom_ec_test_functionality(struct i2c_adapter *adapter)
+{
+	struct qcom_ec_test_context *ctx = i2c_get_adapdata(adapter);
+
+	return ctx->functionality;
+}
+
+static const struct i2c_algorithm qcom_ec_test_algorithm = {
+	.master_xfer = qcom_ec_test_transfer,
+	.smbus_xfer = qcom_ec_test_smbus,
+	.functionality = qcom_ec_test_functionality,
+};
+
+static void qcom_ec_test_delete_adapter(void *data)
+{
+	i2c_del_adapter(data);
+}
+
+static void qcom_ec_test_unregister_client(void *data)
+{
+	i2c_unregister_device(data);
+}
+
+static int qcom_ec_test_init(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx;
+	int ret;
+
+	ctx = kunit_kzalloc(test, sizeof(*ctx), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, ctx);
+	test->priv = ctx;
+	ctx->functionality = I2C_FUNC_I2C | I2C_FUNC_SMBUS_READ_BYTE_DATA |
+			     I2C_FUNC_SMBUS_READ_I2C_BLOCK;
+	ctx->transfer_result = 2;
+	ctx->reply[0] = 2;
+	ctx->byte_result = 36;
+	ctx->adapter.owner = THIS_MODULE;
+	ctx->adapter.algo = &qcom_ec_test_algorithm;
+	strscpy(ctx->adapter.name, "qcom-ec-kunit", sizeof(ctx->adapter.name));
+	i2c_set_adapdata(&ctx->adapter, ctx);
+	ret = i2c_add_adapter(&ctx->adapter);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+	ret = kunit_add_action_or_reset(test, qcom_ec_test_delete_adapter, &ctx->adapter);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+
+	ctx->ec.client = i2c_new_dummy_device(&ctx->adapter, 0x76);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->ec.client);
+	ret = kunit_add_action_or_reset(test, qcom_ec_test_unregister_client, ctx->ec.client);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+	ctx->ec.variant = &qcom_ec_slim7x;
+	i2c_set_clientdata(ctx->ec.client, &ctx->ec);
+
+	return 0;
+}
+
+static void qcom_ec_rpm_test(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx = test->priv;
+	static const struct {
+		int transfer_result;
+		u8 count;
+		int error;
+	} failures[] = {
+		{ 0, 2, -EIO },
+		{ 1, 2, -EIO },
+		{ -EREMOTEIO, 2, -EREMOTEIO },
+		{ -ETIMEDOUT, 2, -ETIMEDOUT },
+		{ 2, 0, -EPROTO },
+		{ 2, 1, -EPROTO },
+		{ 2, 3, -EPROTO },
+		{ 2, 0xff, -EPROTO },
+	};
+	long value = -1;
+	int i;
+
+	KUNIT_EXPECT_EQ(test, qcom_ec_read_fan_rpm(&ctx->ec, &value), 0);
+	KUNIT_EXPECT_EQ(test, value, 0);
+	ctx->reply[1] = 0xef;
+	ctx->reply[2] = 0xbe;
+	KUNIT_EXPECT_EQ(test, qcom_ec_read_fan_rpm(&ctx->ec, &value), 0);
+	KUNIT_EXPECT_EQ(test, value, 0xbeef);
+
+	for (i = 0; i < ARRAY_SIZE(failures); i++) {
+		value = -1;
+		ctx->transfer_result = failures[i].transfer_result;
+		ctx->reply[0] = failures[i].count;
+		KUNIT_EXPECT_EQ_MSG(test, qcom_ec_read_fan_rpm(&ctx->ec, &value),
+				    failures[i].error, "case %d", i);
+		KUNIT_EXPECT_EQ(test, value, -1);
+	}
+	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
+}
+
+static void qcom_ec_temperature_test(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx = test->priv;
+	static const int temperatures[] = { 0, 36, 254, 255, -EREMOTEIO };
+	long value;
+	int i, ret;
+
+	for (i = 0; i < ARRAY_SIZE(temperatures); i++) {
+		value = -1;
+		ctx->byte_result = temperatures[i];
+		ret = qcom_ec_hwmon_read(&ctx->ec.client->dev, hwmon_temp,
+					 hwmon_temp_input, 0, &value);
+		if (temperatures[i] < 0) {
+			KUNIT_EXPECT_EQ(test, ret, temperatures[i]);
+			KUNIT_EXPECT_EQ(test, value, -1);
+		} else if (temperatures[i] == 255) {
+			KUNIT_EXPECT_EQ(test, ret, -ENODATA);
+			KUNIT_EXPECT_EQ(test, value, -1);
+		} else {
+			KUNIT_EXPECT_EQ(test, ret, 0);
+			KUNIT_EXPECT_EQ(test, value, temperatures[i] * 1000);
+		}
+	}
+	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
+}
+
+static void qcom_ec_read_only_test(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx = test->priv;
+	struct device *dev = &ctx->ec.client->dev;
+	long value = -1;
+
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_is_visible(NULL, hwmon_fan, hwmon_fan_input, 0),
+			0444);
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_is_visible(NULL, hwmon_temp, hwmon_temp_input, 0),
+			0444);
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_is_visible(NULL, hwmon_fan, hwmon_fan_input, 1), 0);
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_is_visible(NULL, hwmon_pwm, hwmon_pwm_input, 0), 0);
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_read(dev, hwmon_fan, hwmon_fan_input, 1, &value),
+			-EOPNOTSUPP);
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_read(dev, hwmon_pwm, hwmon_pwm_input, 0, &value),
+			-EOPNOTSUPP);
+	KUNIT_EXPECT_EQ(test, value, -1);
+	KUNIT_EXPECT_EQ(test, qcom_ec_suspend(dev), 0);
+	KUNIT_EXPECT_EQ(test, qcom_ec_resume(dev), 0);
+	qcom_ec_remove(ctx->ec.client);
+	KUNIT_EXPECT_EQ(test, ctx->transactions, 0);
+}
+
+static void qcom_ec_probe_transport_test(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx = test->priv;
+
+	ctx->functionality = I2C_FUNC_I2C;
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_probe(&ctx->ec), -EOPNOTSUPP);
+	ctx->functionality = I2C_FUNC_SMBUS_READ_BYTE_DATA;
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_probe(&ctx->ec), -EOPNOTSUPP);
+	KUNIT_EXPECT_EQ(test, ctx->transactions, 0);
+}
+
+static void qcom_ec_probe_sensor_test(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx = test->priv;
+
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_probe(&ctx->ec), 0);
+	KUNIT_EXPECT_EQ(test, ctx->transactions, 1);
+	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
+	ctx->reply[0] = 0;
+	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_probe(&ctx->ec), -EPROTO);
+	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
+}
+
+static void qcom_ec_reference_validation_test(struct kunit *test)
+{
+	struct qcom_ec_test_context *ctx = test->priv;
+	u8 response[3];
+
+	ctx->block_length = 3;
+	KUNIT_EXPECT_EQ(test, qcom_ec_read(&ctx->ec, EC_THERMAL_CAP_CMD, 3, response), 0);
+	ctx->block_length = 2;
+	KUNIT_EXPECT_EQ(test, qcom_ec_read(&ctx->ec, EC_THERMAL_CAP_CMD, 3, response), -EIO);
+	ctx->block_length = 0;
+	KUNIT_EXPECT_EQ(test, qcom_ec_read(&ctx->ec, EC_THERMAL_CAP_CMD, 3, response),
+			-EOPNOTSUPP);
+	ctx->block_length = 3;
+	ctx->reply[0] = 0;
+	KUNIT_EXPECT_EQ(test, qcom_ec_read(&ctx->ec, EC_THERMAL_CAP_CMD, 3, response), -EINVAL);
+	ctx->reply[0] = 1;
+	KUNIT_EXPECT_EQ(test, qcom_ec_read(&ctx->ec, EC_THERMAL_CAP_CMD, 3, response), -EINVAL);
+	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
+}
+
+static void qcom_ec_variant_test(struct kunit *test)
+{
+	static const char compatible[] = "lenovo,yoga-slim7x-ec\0qcom,hamoa-crd-ec";
+	struct property property = {
+		.name = "compatible",
+		.length = sizeof(compatible),
+		.value = (void *)compatible,
+	};
+	struct device_node node = { .properties = &property };
+	const struct of_device_id *match;
+
+	match = of_match_node(qcom_ec_of_match, &node);
+	KUNIT_ASSERT_NOT_NULL(test, match);
+	KUNIT_EXPECT_PTR_EQ(test, match->data, &qcom_ec_slim7x);
+	property.value = "qcom,hamoa-crd-ec";
+	property.length = sizeof("qcom,hamoa-crd-ec");
+	match = of_match_node(qcom_ec_of_match, &node);
+	KUNIT_ASSERT_NOT_NULL(test, match);
+	KUNIT_EXPECT_PTR_EQ(test, match->data, &qcom_ec_reference);
+}
+
+static struct kunit_case qcom_ec_test_cases[] = {
+	KUNIT_CASE(qcom_ec_rpm_test),
+	KUNIT_CASE(qcom_ec_temperature_test),
+	KUNIT_CASE(qcom_ec_read_only_test),
+	KUNIT_CASE(qcom_ec_probe_transport_test),
+	KUNIT_CASE(qcom_ec_probe_sensor_test),
+	KUNIT_CASE(qcom_ec_reference_validation_test),
+	KUNIT_CASE(qcom_ec_variant_test),
+	{}
+};
+
+static struct kunit_suite qcom_ec_test_suite = {
+	.name = "qcom-hamoa-ec",
+	.init = qcom_ec_test_init,
+	.test_cases = qcom_ec_test_cases,
+};
+
+kunit_test_suite(qcom_ec_test_suite);
diff --git a/drivers/platform/arm64/qcom-hamoa-ec.c b/drivers/platform/arm64/qcom-hamoa-ec.c
index 3a4ca8a0d..043f6ab7e 100644
--- a/drivers/platform/arm64/qcom-hamoa-ec.c
+++ b/drivers/platform/arm64/qcom-hamoa-ec.c
@@ -596,3 +596,7 @@ module_i2c_driver(qcom_ec_i2c_driver);
 
 MODULE_DESCRIPTION("QCOM Hamoa Embedded Controller");
 MODULE_LICENSE("GPL");
+
+#if IS_ENABLED(CONFIG_EC_QCOM_HAMOA_KUNIT_TEST)
+#include "qcom-hamoa-ec-test.c"
+#endif
-- 
2.53.0

Re: [RFC PATCH 1/2] platform: arm64: qcom-hamoa-ec: monitor Slim 7x legacy sensors

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Hardware monitoring functionality is registered directly from a platform driver outside of the drivers/hwmon/ directory.
--

commit 763b40f1f55a5efec49b9919dd06a1242c3e47c2
Author: Birk Skyum <birk.skyum@pm.me>

platform: arm64: qcom-hamoa-ec: monitor Slim 7x legacy sensors

This commit adds read-only fan speed and thermistor monitoring for the
Lenovo Yoga Slim 7x embedded controller using a legacy interface.

Link: https://github.com/aarch64-laptops/build/blob/2e58842f5fa2f87771c2df017ae4d8c65225ef10/misc/lenovo-yoga-slim-7x/acpi/dsdt.dsl
Link: https://lkml.iu.edu/hypermail/linux/kernel/2607.3/08806.html

> diff --git a/drivers/platform/arm64/qcom-hamoa-ec.c b/drivers/platform/arm64/qcom-hamoa-ec.c
> index 4d2ad042a7f84..3a4ca8a0de5c8 100644
> --- a/drivers/platform/arm64/qcom-hamoa-ec.c
> +++ b/drivers/platform/arm64/qcom-hamoa-ec.c

[ ... ]

> +static int qcom_ec_hwmon_probe(struct qcom_ec *ec)
> +{
> +	struct device *dev = &ec->client->dev;
> +	struct device *hwmon;
> +	long rpm;
> +	int ret;
> +
> +	if (!i2c_check_functionality(ec->client->adapter,
> +				     I2C_FUNC_I2C | I2C_FUNC_SMBUS_READ_BYTE_DATA))
> +		return -EOPNOTSUPP;
> +
> +	ret = qcom_ec_read_fan_rpm(ec, &rpm);
> +	if (ret)
> +		return dev_err_probe(dev, ret, "Failed to read fan RPM\n");
> +
> +	hwmon = devm_hwmon_device_register_with_info(dev, "qcom_ec", ec,
> +						     &qcom_ec_hwmon_chip_info, NULL);

[Severity: Low]
Does this violate the hardware monitoring subsystem layering rules by
registering a hwmon device directly from drivers/platform/arm64/ within
qcom_ec_hwmon_probe?

Since the main functionality of this EC chip is not hardware monitoring,
should the hwmon functionality be implemented as an auxiliary device driver
residing in drivers/hwmon/ to avoid bypassing maintainer review and
increasing driver complexity?

> +	return PTR_ERR_OR_ZERO(hwmon);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908015650.84401-1-birk.skyum@pm.me?part=1

Re: [RFC PATCH 2/2] platform: arm64: qcom-hamoa-ec: test sensor and variant handling

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Unresolvable devres reference loop causes a permanent hang during KUnit test cleanup.
- [Medium] Hardware monitoring device registered from a platform driver outside of drivers/hwmon/.
--

commit 10084c21cb97238d4ea1fb5148e02186d2b75bb5
Author: Birk Skyum <birk.skyum@pm.me>

platform: arm64: qcom-hamoa-ec: test sensor and variant handling

This commit introduces KUnit tests for the Qualcomm EC driver's sensor
transactions and read-only callbacks. The tests simulate an I2C adapter to
verify RPM decoding, short transfers, and error propagation without
accessing a physical EC.

> diff --git a/drivers/platform/arm64/qcom-hamoa-ec-test.c b/drivers/platform/arm64/qcom-hamoa-ec-test.c
> new file mode 100644
> index 0000000000000..68868ef7625ae
> --- /dev/null
> +++ b/drivers/platform/arm64/qcom-hamoa-ec-test.c
[ ... ]
> @@ -0,0 +1,294 @@
[ ... ]
> +static void qcom_ec_probe_sensor_test(struct kunit *test)
> +{
> +	struct qcom_ec_test_context *ctx = test->priv;
> +
> +	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_probe(&ctx->ec), 0);

[Severity: High]
Does manually invoking qcom_ec_hwmon_probe() on a dummy I2C client cause a
permanent kernel hang during test cleanup?

The KUnit test creates a dummy I2C client using i2c_new_dummy_device(),
which lacks a bound driver. When qcom_ec_hwmon_probe() is manually invoked,
it allocates a child hwmon device via devm_hwmon_device_register_with_info():

drivers/platform/arm64/qcom-hamoa-ec.c:qcom_ec_hwmon_probe() {
    ...
    hwmon = devm_hwmon_device_register_with_info(dev, "qcom_ec", ec,
                                                 &qcom_ec_hwmon_chip_info,
                                                 NULL);
    ...
}

Because the dummy client has no bound driver, devres cleanup is deferred
until its kobject refcount reaches zero. However, the registered child hwmon
device takes a kobject reference on the dummy client. This creates an
unresolvable cycle where the parent refcount cannot reach zero until the
child hwmon device is unregistered, which is supposed to happen in the
devres cleanup.

This prevents the dummy client from being freed, causing the subsequent
i2c_del_adapter() in test cleanup to block forever in
wait_for_completion(&adap->dev_released).

[Severity: Medium]
Does this code register a hardware monitoring device from a driver located
outside of the drivers/hwmon/ directory?

The hwmon subsystem architecture requires that hardware monitoring devices
be registered from drivers residing in drivers/hwmon/. If the main
functionality of the chip is not hardware monitoring, the hardware
monitoring functionality should be implemented as an auxiliary device driver
residing in drivers/hwmon/.

Here, devm_hwmon_device_register_with_info() is called directly by a
platform driver located in drivers/platform/arm64/:

drivers/platform/arm64/qcom-hamoa-ec.c:qcom_ec_hwmon_probe() {
    ...
    hwmon = devm_hwmon_device_register_with_info(dev, "qcom_ec", ec,
                                                 &qcom_ec_hwmon_chip_info,
                                                 NULL);
    ...
}

> +	KUNIT_EXPECT_EQ(test, ctx->transactions, 1);
> +	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
> +	ctx->reply[0] = 0;
> +	KUNIT_EXPECT_EQ(test, qcom_ec_hwmon_probe(&ctx->ec), -EPROTO);
> +	KUNIT_EXPECT_EQ(test, ctx->writes, 0);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908015650.84401-1-birk.skyum@pm.me?part=2

Re: [RFC PATCH 2/2] platform: arm64: qcom-hamoa-ec: test sensor and variant handling

[Birk Skyum]

Thanks for checking this.

The test client is bound to the I2C core's dummy driver by
i2c_new_dummy_device(). Unregistering it unbinds that driver and releases
the managed hwmon child before the adapter is deleted. I reran the arm64
KUnit image on the stated 7.3-rc2 base; all seven cases completed and the
guest rebooted normally, including cleanup after the sensor-probe test.

The dummy-driver binding is also documented here:
https://docs.kernel.org/driver-api/i2c.html#c.i2c_new_dummy_device

For the hwmon placement, I kept the small read-only sensor path in the
existing EC driver, as huawei-gaokun-ec does. Guenter and linux-hwmon are
already copied. Would an auxiliary driver under drivers/hwmon be preferred
here? I'm happy to split it if that is the preferred direction.

Re: [RFC PATCH 1/2] platform: arm64: qcom-hamoa-ec: monitor Slim 7x legacy sensors

[Guenter Roeck]

On 9/7/26 18:57, Birk Skyum wrote:
> The Yoga Slim 7x EC returns an all-zero response to the reference-board
> thermal capability command. Probe fails even though its legacy RPM and
> thermistor queries work and firmware controls the fan automatically.
> 
> Select a read-only path for the Lenovo compatible. Expose its first RPM
> channel and thermistor through hwmon, validating the transfer length and
> RPM payload count and treating the thermistor's 0xff sentinel as ENODATA.
> Do not enable SCI, register manual cooling controls or send standby
> commands on this path. Keep the reference-board behavior and strict
> capability validation unchanged.
> 
> The transactions are documented by the Yoga's FC22 and FC29/TZ39 DSDT
> methods and Maya Matuszczyk's EC protocol notes. Anvesh Jain P's pending
> fan-profile series also documents the RPM query. This change does not
> include its calibration, LUT programming or temperature reporting.
> 
> Link: https://github.com/aarch64-laptops/build/blob/2e58842f5fa2f87771c2df017ae4d8c65225ef10/misc/lenovo-yoga-slim-7x/acpi/dsdt.dsl
> Link: https://lkml.iu.edu/hypermail/linux/kernel/2607.3/08806.html
> Signed-off-by: Birk Skyum <birk.skyum@pm.me>
> ---
>   Documentation/hwmon/index.rst          |   1 +
>   Documentation/hwmon/qcom-ec.rst        |  40 +++++++

Platform drivers are not documented here. This directory is intended
for hardware moitoring drivers in the drivers/hwmon/ directory.

Guenter

Re: [RFC PATCH 2/2] platform: arm64: qcom-hamoa-ec: test sensor and variant handling

[Guenter Roeck]

On 9/7/26 19:18, Birk Skyum wrote:
> Thanks for checking this.
> 
> The test client is bound to the I2C core's dummy driver by
> i2c_new_dummy_device(). Unregistering it unbinds that driver and releases
> the managed hwmon child before the adapter is deleted. I reran the arm64
> KUnit image on the stated 7.3-rc2 base; all seven cases completed and the
> guest rebooted normally, including cleanup after the sensor-probe test.
> 
> The dummy-driver binding is also documented here:
> https://docs.kernel.org/driver-api/i2c.html#c.i2c_new_dummy_device
> 
> For the hwmon placement, I kept the small read-only sensor path in the
> existing EC driver, as huawei-gaokun-ec does. Guenter and linux-hwmon are
> already copied. Would an auxiliary driver under drivers/hwmon be preferred
> here? I'm happy to split it if that is the preferred direction.


Your call, really, but it is all or nothing as mentioned
in the other patch. Platform drivers are not documented in
Documentation/hwmon/.

Guenter