Add read-only Xiaomi TM2424 fan tachometer module

[Xiaofeng-used]

Summary

• add a read-only fan tachometer module for the Xiaomi Book Pro 14 (TM2424)
• expose the two MIFS v2 EC shared-memory tachometers as raw RPM values
• expose platform identity and mapping information for consumers

Hardware guard

The fixed EC window is mapped only after matching both of the identifiers observed on the supported machine:

• Intel LPC/eSPI: PCI VEN_8086 DEV_E402
• Xiaomi subsystem: SUBSYS_24241D72

Test system identity: XIAOMI Xiaomi Book Pro 14, SKU TM2424-77079, baseboard TM2424 V14D1, Intel Core Ultra X7 358H.

Safety and consumer contract

• the module references no MMIO, PCI configuration, I/O-port, or MSR write native
• ioctl_read_fans returns { left_rpm, right_rpm }; zero means stopped
• ioctl_identity returns the matched PCI IDs and mapped MMIO window
• unsupported platforms fail before io_space_map

Validation

• compiled successfully with Pawn 4.1.7487 using -p -iinclude -C64
• the only compiler warning is the existing include/pawnio.inc:40 old-style forward declaration warning, also reproduced unchanged when compiling Echo.p with that newer compiler
• git diff --check passes
• verified by source inspection that no write native is referenced

The stock PawnIO driver rejects unsigned modules, so hardware loading on Windows requires the signed build produced after upstream acceptance. I did not weaken Secure Boot or memory integrity to bypass that restriction.

Reference

Linux patch: platform/x86: bitland-mifs-wmi: read fan tach from EC window on MIFS v2

That patch documents the DSDT \\_SB.PC00.LPCB.Q_EC ERAM window at 0xFE0B0300 and little-endian u16 RPM values at offsets 0x69 and 0x6B. Its author reports validating the values by comparing idle and sustained-load samples, observing both tachometers ramp from 0 to approximately 2700 RPM and back on a Xiaomi Book Pro 14.

[Xiaofeng-used]

Hi, I have the exact target hardware available for testing:

• XIAOMI Xiaomi Book Pro 14
• SKU: TM2424-77079
• Baseboard: TM2424 V14D1
• LPC/eSPI: PCI VEN_8086&DEV_E402&SUBSYS_24241D72

Would it be possible to provide a temporary maintainer-signed test build of XiaomiTm2424Fan before the next regular signed release? The stock PawnIO driver rejects the locally compiled unsigned module, and I would prefer not to disable Secure Boot or Windows memory integrity on this machine.

With a signed test build I can validate the complete Windows path and report back:

1. whether the stock PawnIO driver loads the module;
2. raw left/right RPM values at idle;
3. RPM changes during sustained CPU load and cooldown;
4. any load or IOCTL errors, together with the corresponding NTSTATUS values.

If providing a pre-release signed artifact is not possible, no problem — I can wait for the normal signed release after review. Thanks.

[namazso]

Would it be possible to provide a temporary maintainer-signed test build of XiaomiTm2424Fan before the next regular signed release?

No, signature revocation for modules is not a thing, so temporary maintainer-signed is not something that can possibly exist.

I changed this to draft, please test it on the unrestricted driver (you'll have to use 2.1.0 or your own builds because 2.2.0 accidentally shipped with signature verification enabled on the unrestricted driver as well) before marking it as ready.

[Xiaofeng-used]

Hardware validation completed successfully against commit
f83f737695cfa6edeb9771f2bb716271dbad3a15.

Test environment:

• Xiaomi Book Pro 14
• SKU: TM2424-77079
• Baseboard: TM2424 V14D1
• CPU: Intel Core Ultra X7 358H, 16 logical processors
• Windows 11 10.0.26200
• PawnIO driver version reported by IOCTL: 2.2.0
• Self-built unrestricted standalone development driver (PAWNIO_UNRESTRICTED=ON, PAWNIO_STANDALONE=ON)
• Windows Test Mode enabled, Secure Boot disabled
• Memory Integrity remained enabled
• AMX SHA-256: AD0DC29B18FEDA29970EC5DBC07AEDFA10F688FD255E2F03A182C86FB22150A9

The raw AMX was supplied using the normal PawnIO blob format with a uint32 signature length of zero, as required for unrestricted-driver testing.

Results:

• IOCTL_PIO_LOAD_BINARY: successful
• ioctl_read_fans: successful
• Returned size: 16 bytes
• No load or execute errors
• Idle baseline:
  • Left: 2965–3037 RPM
  • Right: 2944–3022 RPM
• Sustained 100% CPU load for approximately 45 seconds:
  • Left peak: 4548 RPM
  • Right peak: 4643 RPM
• After the load stopped, both fans remained elevated briefly and then began decreasing normally.
• Both tachometers changed smoothly with load and remained closely matched.
• No EC write operations were performed.

This validates the PCI identity checks, EC mapping, both tachometer offsets, and the complete module load/execute path on the target hardware.

The module is ready for review.