linux-toradex.git/drivers/hwmon, branch master Linux kernel for Apalis and Colibri modules hwmon: (npcm750-pwm-fan) serialize PWM register updates 2026-10-20T22:41:38+00:00 Josef Bacik josef@toxicpanda.com 2026-10-03T18:16:42+00:00 e1b3c2630d5b8bc755fe4ba86d20d08c734eb504 npcm7xx_pwm_config_set() writes the channel's CMR register and then does a read-modify-write of the CR register that holds the enable and invert bits of all four channels of a PWM module. It is called from the hwmon pwm write path and from npcm7xx_pwm_cz_set_cur_state(), the set_cur_state callback of the thermal cooling devices the driver registers for channels with "cooling-levels". The per-module pwm_lock serializing these updates was dropped on the assumption that the hwmon core serializes all attribute accesses. That only covers the hwmon attributes: the cooling devices are registered directly with the thermal core, which only holds the lock of the cooling device being updated. So a thermal zone update or a write to a cooling device's cur_state can run concurrently with a pwm write, or with the cooling device of another channel of the same module, and one CR update overwrites the other: CPU0 (pwmN write) CPU1 (cooling dev, same module) tmp = ioread32(CR) tmp = ioread32(CR) tmp |= ch1 enable iowrite32(tmp, CR) tmp |= ch0 enable iowrite32(tmp, CR) /* ch1 enable bit lost */ leaving a fan stopped or running at a duty cycle that no longer matches its enable state. The bug was found by code inspection and has not been reproduced. Fix by restoring a per-module mutex around the register updates; a driver lock is used instead of hwmon_lock() because the cooling devices are registered before the hwmon device exists. Fixes: abfb05085177 ("hwmon: (corsair-psu) Rely on subsystem locking") Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
npcm7xx_pwm_config_set() writes the channel's CMR register and then
does a read-modify-write of the CR register that holds the enable and
invert bits of all four channels of a PWM module. It is called from the
hwmon pwm write path and from npcm7xx_pwm_cz_set_cur_state(), the
set_cur_state callback of the thermal cooling devices the driver
registers for channels with "cooling-levels".

The per-module pwm_lock serializing these updates was dropped on the
assumption that the hwmon core serializes all attribute accesses. That
only covers the hwmon attributes: the cooling devices are registered
directly with the thermal core, which only holds the lock of the
cooling device being updated. So a thermal zone update or a write to a
cooling device's cur_state can run concurrently with a pwm write, or
with the cooling device of another channel of the same module, and one
CR update overwrites the other:

    CPU0 (pwmN write)               CPU1 (cooling dev, same module)
    tmp = ioread32(CR)
                                    tmp = ioread32(CR)
                                    tmp |= ch1 enable
                                    iowrite32(tmp, CR)
    tmp |= ch0 enable
    iowrite32(tmp, CR)              /* ch1 enable bit lost */

leaving a fan stopped or running at a duty cycle that no longer matches
its enable state.

The bug was found by code inspection and has not been reproduced.

Fix by restoring a per-module mutex around the register updates; a
driver lock is used instead of hwmon_lock() because the cooling devices
are registered before the hwmon device exists.

Fixes: abfb05085177 ("hwmon: (corsair-psu) Rely on subsystem locking")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (nct7904) serialise the watchdog and sensors 2026-10-20T22:41:30+00:00 Josef Bacik josef@toxicpanda.com 2026-10-04T22:15:39+00:00 b8249a3b6b36937e660d7217773ab18111c6b7fe The registers of the chip are banked: each access selects the bank, which is cached in data->bank_sel, and then reads or writes the register. bank_lock used to make the two steps atomic. It has been removed because the hwmon core serialises the sensor callbacks, but the watchdog callbacks use the same access functions and are not called by the hwmon core. So a sensor can now be read while the watchdog is being pinged. If one of them selects its bank between the two steps of the other, the second step hits a register of the wrong bank: the watchdog is not fed, or its commands are written to some sensor or fan control register. Take the lock of the hwmon device in the watchdog callbacks. The watchdog is registered after the hwmon device, and devres unregisters it first. Fixes: 9ad270bf4dcc ("hwmon: (nct7904) Rely on subsystem locking") Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
The registers of the chip are banked: each access selects the bank, which
is cached in data->bank_sel, and then reads or writes the register.
bank_lock used to make the two steps atomic.  It has been removed because
the hwmon core serialises the sensor callbacks, but the watchdog callbacks
use the same access functions and are not called by the hwmon core.

So a sensor can now be read while the watchdog is being pinged.  If one of
them selects its bank between the two steps of the other, the second step
hits a register of the wrong bank: the watchdog is not fed, or its
commands are written to some sensor or fan control register.

Take the lock of the hwmon device in the watchdog callbacks.  The watchdog
is registered after the hwmon device, and devres unregisters it first.

Fixes: 9ad270bf4dcc ("hwmon: (nct7904) Rely on subsystem locking")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (ftsteutates) serialise the watchdog and sensors 2026-10-20T22:41:23+00:00 Josef Bacik josef@toxicpanda.com 2026-10-04T22:15:41+00:00 2281f0473fa257d19d59c9e430e91b5a76f418bc The registers of the chip are paged: fts_read_byte() and fts_write_byte() select the page and then access the register. access_lock used to make the two steps atomic. It has been removed because the hwmon core serialises the sensor callbacks, but the watchdog code uses the same two functions and is not called by the hwmon core. So the sensors can now be read, or an alarm be cleared, while the watchdog is being started or stopped. If one of them selects its page between the two steps of the other, the second step hits a register of the wrong page. Take the lock of the hwmon device in the watchdog callbacks, and for the accesses of fts_watchdog_init(), which runs when the hwmon device has already been registered. These are moved to a function of their own, so that the lock is not held while the watchdog is being registered. devres unregisters the watchdog before the hwmon device. Fixes: fa035d98dbae ("hwmon: (ftsteutates) Rely on subsystem locking") Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
The registers of the chip are paged: fts_read_byte() and fts_write_byte()
select the page and then access the register.  access_lock used to make
the two steps atomic.  It has been removed because the hwmon core
serialises the sensor callbacks, but the watchdog code uses the same two
functions and is not called by the hwmon core.

So the sensors can now be read, or an alarm be cleared, while the watchdog
is being started or stopped.  If one of them selects its page between the
two steps of the other, the second step hits a register of the wrong page.

Take the lock of the hwmon device in the watchdog callbacks, and for the
accesses of fts_watchdog_init(), which runs when the hwmon device has
already been registered.  These are moved to a function of their own, so
that the lock is not held while the watchdog is being registered.  devres
unregisters the watchdog before the hwmon device.

Fixes: fa035d98dbae ("hwmon: (ftsteutates) Rely on subsystem locking")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (acpi_power_meter) Fix 18.45 TW bug 2026-10-19T20:54:04+00:00 Armin Wolf W_Armin@gmx.de 2026-10-06T23:45:34+00:00 0b6eda22f9ab67ddb2a872b0c3fc578ad9f4e27e The ACPI specification says: "If an error occurs while obtaining the meter reading or if the value is not available then an Integer with all bits set is returned" This integer can also be 64-bit wide on ACPI 2.0 and later systems, so we have to check for that too. Compile-tested only. Reported-by: Grant Slater <github@firefishy.com> Closes: https://github.com/lm-sensors/lm-sensors/issues/460 Fixes: 1fefca6c57fb ("hwmon: (acpi_power_meter) Fix 4.29 MW bug") Cc: stable@vger.kernel.org Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20261006234618.10943-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
The ACPI specification says:

"If an error occurs while obtaining the meter reading or if the value
is not available then an Integer with all bits set is returned"

This integer can also be 64-bit wide on ACPI 2.0 and later systems,
so we have to check for that too.

Compile-tested only.

Reported-by: Grant Slater <github@firefishy.com>
Closes: https://github.com/lm-sensors/lm-sensors/issues/460
Fixes: 1fefca6c57fb ("hwmon: (acpi_power_meter) Fix 4.29 MW bug")
Cc: stable@vger.kernel.org
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20261006234618.10943-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (sht3x) Return the consumed count for heater writes 2026-10-19T20:15:33+00:00 Baek Kyu, Kim pocj8ur4in@gmail.com 2026-10-19T15:47:18+00:00 817ac527100c8e20684211eb919ffd6d875adc7a heater_enable_store() returns the result of i2c_master_send(), which is the two-byte command length on success rather than the sysfs input count. This can report more bytes than were supplied, or a partial write for a fully processed input. For example, writing "on\n" returns two instead of three, so a caller retrying the remaining newline gets -EINVAL even though the heater command succeeded. Retrying the remainder of "off\n" can also send the heater-off command twice. Return count after a complete command transfer. Preserve negative I2C errors and return -EIO for nonnegative incomplete transfers, so a zero-message transfer is not reported as a successful zero-byte write. Keep the existing boolean parsing, command selection and locking. Fixes: 50c22cd154e5 ("hwmon: (sht3x) add humidity heater element control") Cc: stable@vger.kernel.org Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com> Link: https://patch.msgid.link/20261019154718.2328055-1-pocj8ur4in@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
heater_enable_store() returns the result of i2c_master_send(), which is
the two-byte command length on success rather than the sysfs input
count. This can report more bytes than were supplied, or a partial write
for a fully processed input. For example, writing "on\n" returns two
instead of three, so a caller retrying the remaining newline gets
-EINVAL even though the heater command succeeded. Retrying the remainder
of "off\n" can also send the heater-off command twice.

Return count after a complete command transfer. Preserve negative I2C
errors and return -EIO for nonnegative incomplete transfers, so a
zero-message transfer is not reported as a successful zero-byte write.
Keep the existing boolean parsing, command selection and locking.

Fixes: 50c22cd154e5 ("hwmon: (sht3x) add humidity heater element control")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Link: https://patch.msgid.link/20261019154718.2328055-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (mcp9982) Update the interval cache only after successful writes 2026-10-19T20:15:24+00:00 Baek Kyu, Kim pocj8ur4in@gmail.com 2026-10-18T05:57:50+00:00 fcf9aa9beb773bed9d2183bf34f822de12b2c91c mcp9982_write() updates interval_idx before writing the conversion-rate register. If the write fails without changing the register, subsequent update_interval reads report the requested interval instead of the previous setting. Update interval_idx only after regmap_write() succeeds, leaving the previous cached interval in place on error. Fixes: e2fe950f34e5 ("hwmon: add support for MCP998X") Cc: stable@vger.kernel.org Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com> Acked-by: Duicu Victor <victor.duicu@microchip.com> Link: https://patch.msgid.link/20261018055750.1318723-1-pocj8ur4in@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
mcp9982_write() updates interval_idx before writing the conversion-rate
register. If the write fails without changing the register, subsequent
update_interval reads report the requested interval instead of the
previous setting.

Update interval_idx only after regmap_write() succeeds, leaving the
previous cached interval in place on error.

Fixes: e2fe950f34e5 ("hwmon: add support for MCP998X")
Cc: stable@vger.kernel.org
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
Acked-by: Duicu Victor <victor.duicu@microchip.com>
Link: https://patch.msgid.link/20261018055750.1318723-1-pocj8ur4in@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (gigabyte_waterforce) reject short input reports 2026-10-19T12:48:34+00:00 Jiale Yao yaojiale02@163.com 2026-09-27T08:49:59+00:00 400be69515c327ced60082b27ede902a8d93cbdb The HID raw_event callback runs before HID core validates the received report length. waterforce_raw_event() reads command bytes and then accesses fixed offsets for firmware or status data without any length checks. A truncated report can therefore cause out-of-bounds reads and update hwmon state with unrelated data. Require every report to contain the firmware response fields, which also covers both command bytes. After identifying a status response, require the byte at the highest status offset before accessing its payload. Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers") Cc: stable@vger.kernel.org Signed-off-by: Jiale Yao <yaojiale02@163.com> Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
The HID raw_event callback runs before HID core validates the received
report length. waterforce_raw_event() reads command bytes and then accesses
fixed offsets for firmware or status data without any length checks. A
truncated report can therefore cause out-of-bounds reads and update hwmon
state with unrelated data.

Require every report to contain the firmware response fields, which also
covers both command bytes. After identifying a status response, require
the byte at the highest status offset before accessing its payload.

Fixes: 42ac68e3d4ba ("hwmon: Add driver for Gigabyte AORUS Waterforce AIO coolers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://patch.msgid.link/20260927084959.893708-1-yaojiale02@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: (coretemp) Fix handling of isolated SMT siblings 2026-10-19T12:45:47+00:00 Ximing Zhang xzhangjr@gmail.com 2026-10-16T08:36:37+00:00 37c1974a0ec4ec4624a270291a179c53f8f4fbca Commit 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs") prevents create_core_data() from creating temperature data for an isolated CPU. coretemp_cpu_online(), however, still adds that CPU to pdata->cpumask. When an isolated SMT thread is processed before a housekeeping sibling, the mask makes coretemp_cpu_online() believe that the core is already represented. The housekeeping sibling then gets no temperature attributes. Package attributes are similarly not retried when the first CPU processed in a die is isolated. The mask is also used to select a replacement CPU when a sensor target goes offline. Including isolated CPUs permits the driver to retarget a sensor to one, causing subsequent sysfs reads to send an RDMSR IPI to an isolated CPU. Keep isolated CPUs out of pdata->cpumask by moving the housekeeping check to coretemp_cpu_online(). Sensor creation is then deferred to an eligible CPU, and hotplug replacement targets remain on housekeeping CPUs. Tested on an Intel Core i7-10510U running 6.18.50-3-cachyos-lts, with nohz_full=1 on CPU 1 and its housekeeping SMT sibling on CPU 5. The stock driver omitted Core 1 after module load and retained its readable sensor after CPU 5 was offlined. The patched driver exposed Core 1, removed it when CPU 5 went offline, and restored it when CPU 5 returned. Fixes: 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs") Cc: stable@vger.kernel.org Cc: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Ximing Zhang <xzhangjr@gmail.com> Tested-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com> Link: https://patch.msgid.link/20261016-codex-coretemp-housekeeping-v1-1-96618c5676b2@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
Commit 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to
isolated CPUs") prevents create_core_data() from creating temperature
data for an isolated CPU. coretemp_cpu_online(), however, still adds
that CPU to pdata->cpumask.

When an isolated SMT thread is processed before a housekeeping sibling,
the mask makes coretemp_cpu_online() believe that the core is already
represented. The housekeeping sibling then gets no temperature
attributes. Package attributes are similarly not retried when the first
CPU processed in a die is isolated.

The mask is also used to select a replacement CPU when a sensor target
goes offline. Including isolated CPUs permits the driver to retarget a
sensor to one, causing subsequent sysfs reads to send an RDMSR IPI to an
isolated CPU.

Keep isolated CPUs out of pdata->cpumask by moving the housekeeping check
to coretemp_cpu_online(). Sensor creation is then deferred to an eligible
CPU, and hotplug replacement targets remain on housekeeping CPUs.

Tested on an Intel Core i7-10510U running 6.18.50-3-cachyos-lts, with
nohz_full=1 on CPU 1 and its housekeeping SMT sibling on CPU 5. The stock
driver omitted Core 1 after module load and retained its readable sensor
after CPU 5 was offlined. The patched driver exposed Core 1, removed it
when CPU 5 went offline, and restored it when CPU 5 returned.

Fixes: 0f8b916bc5b5 ("hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs")
Cc: stable@vger.kernel.org
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Ximing Zhang <xzhangjr@gmail.com>
Tested-by: Asaf Nuri Bertizlioğlu <ycistak@gmail.com>
Link: https://patch.msgid.link/20261016-codex-coretemp-housekeeping-v1-1-96618c5676b2@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon: Replace __MODULE_STRING() with __stringify() 2026-10-18T16:35:08+00:00 Petr Pavlu petr.pavlu@suse.com 2026-10-02T08:31:01+00:00 c4f7b23fe52316438a9480052a51a0a5701e940b __MODULE_STRING() has been an alias for __stringify() since "[PATCH] MODULE_PARM support for older modules" [1] in 2002-12. That change also moved it to the graveyard section at the end of linux/module.h Replace the remaining uses of __MODULE_STRING() with __stringify() in preparation for its removal. Link: https://git.kernel.org/tglx/history/c/136839a1b4 [1] Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Link: https://patch.msgid.link/20261002-module-string-v2-1-fc7438acaf4d@suse.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
__MODULE_STRING() has been an alias for __stringify() since "[PATCH]
MODULE_PARM support for older modules" [1] in 2002-12. That change also
moved it to the graveyard section at the end of linux/module.h

Replace the remaining uses of __MODULE_STRING() with __stringify() in
preparation for its removal.

Link: https://git.kernel.org/tglx/history/c/136839a1b4 [1]
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Link: https://patch.msgid.link/20261002-module-string-v2-1-fc7438acaf4d@suse.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
hwmon:(pmbus/xdpe1a2g7b) Add support for xdpe1a2g7c controller 2026-10-18T16:35:08+00:00 Ashish Yadav ashish.yadav@infineon.com 2026-09-21T06:57:02+00:00 0fc3a31f627f05d2e0da59d30622c74d94071176 Extend xdpe1a2g7b driver to support xdpe1a2g7c model. Signed-off-by: Ashish Yadav <ashish.yadav@infineon.com> Link: https://patch.msgid.link/20260921065702.93196-3-Ashish.Yadav@infineon.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> 
Extend xdpe1a2g7b driver to support xdpe1a2g7c model.

Signed-off-by: Ashish Yadav <ashish.yadav@infineon.com>
Link: https://patch.msgid.link/20260921065702.93196-3-Ashish.Yadav@infineon.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>