Re: [PATCH v3 2/2] hwmon: (pmbus/tda38740) Add driver for Infineon TDA38740/TDA38725

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The driver intercepts PMBUS_READ_VOUT to apply `vout_scale_micro` but fails to scale VOUT limits during reads and completely omits a write hook, leading to dangerous unscaled hardware writes.
--

commit 1abfb85e1a82a16c8ba7229d3c9657b7d232835d
Author: Colin Huang <u8813345@gmail.com>

hwmon: (pmbus/tda38740) Add driver for Infineon TDA38740/TDA38725
    
Add a PMBus driver for Infineon TDA38740 and TDA38725
single-voltage synchronous buck regulators.

> diff --git a/drivers/hwmon/pmbus/tda38740.c b/drivers/hwmon/pmbus/tda38740.c
> new file mode 100644
> index 0000000000000..df5173d8da0c1
> --- /dev/null
> +++ b/drivers/hwmon/pmbus/tda38740.c
[ ... ]
> +static int tda38740_read_word_data(struct i2c_client *client, int page,
> +				   int phase, int reg)
> +{
> +	const struct tda38740_data *data;
> +	int ret;
> +	u64 scaled;
> +
> +	if (reg != PMBUS_READ_VOUT)
> +		return -ENODATA;

[Severity: High]
Does this bypass software scaling for all VOUT-related limit commands?

By returning -ENODATA for anything other than PMBUS_READ_VOUT, the PMBus
core falls back to unscaled hardware reads for VOUT limits (e.g., in1_crit
or in1_input limits).

Should this function also scale the limit registers when they are read?

> +
> +	ret = pmbus_read_word_data(client, page, phase, reg);
> +	if (ret < 0)
> +		return ret;
[ ... ]
> +static int tda38740_probe(struct i2c_client *client)
> +{
[ ... ]
> +	memcpy(&data->info, &tda38740_info, sizeof(tda38740_info));
> +	data->vout_scale_micro = vout_scale_micro;
> +	data->info.read_word_data = tda38740_read_word_data;
> +
> +	return pmbus_do_probe(client, &data->info);

[Severity: High]
Is there a missing write_word_data hook here?

Since the driver intercepts reads to apply vout_scale_micro, writes to limit
registers currently fall back to unscaled hardware writes.

If a user writes a 1.5V limit for a board with a 2x voltage divider, the PMBus
core writes 1.5V directly to hardware without scaling. The hardware then
regulates or triggers a fault only when the pin reaches 1.5V, which corresponds
to 3.0V on the board, potentially causing physical damage.

Could we add a write_word_data hook to ensure VOUT limit writes are scaled
correctly?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910-add-tda38740-and-tda38725-v3-0-3e87637da3d6@gmail.com?part=2