[PATCH] hwmon: (it87) Add support for IT8607E

[PATCH] hwmon: (it87) Add support for IT8607E

[Ismael Ojeda Perez]

The IT8607E is the Super I/O of the Intel NUC6i3SYB and, according to
Intel's product specification, the NUC6i5SYB (BIOS SYSKLi35.86A). Its
environment controller is hidden from ACPI (HHMD._STA returns 0), so the
chip is only reachable through the LPC configuration ports, and the ACPI
resource check must be bypassed with ignore_resource_conflict=1.

No datasheet is available. The register layout was compared against the
IT8603E, and the BIOS fan setup (IT8607PeiInit and FanPei PEI modules of
SYSKLi35.86A.0071) was disassembled to confirm it programs the same
"newer autopwm" registers (0x68-0x6d for pwm2). Features are therefore
copied from the IT8603E.

Tested on a NUC6i3SYB (BIOS SYSKLi35.86A.0042, chip ID 0x8607, rev 2):
temperatures agree with coretemp, +3.3V reads 3.31 V, the 3VSB and VBAT
inputs read plausible values, fan2 tach and pwm2 respond to the
automatic-curve registers (start 74 C, full speed 92 C, as programmed by
the BIOS) and to manual mode, and the original values are restored.

The tachometer was not compared with an external tachometer and the
voltage scaling was not compared with a multimeter; the values above are
only cross-checked against coretemp and the expected rail voltages.

Signed-off-by: Ismael Ojeda Perez <iojedaperez@proton.me>
---
Notes (not part of the commit message):

Based on the hwmon-next branch of groeck/linux-staging.git (file contents
as of 2026-11-01). Also compiled as a module against 6.18.58.

Sample output on the NUC6i3SYB with it87 loaded with
ignore_resource_conflict=1 (raw sysfs, hwmon5 = it8607):

  in0_input=828  in1_input=1212  in2_input=2004  in3_input=2004
  in4_input=2016  in7_input=3312 (3VSB)  in8_input=2808 (Vbat)
  in9_input=3312 (+3.3V)
  temp1_input=72000  temp2_input=67000  temp3_input=74000
  fan1_input=0  fan2_input=4623
  pwm2=89  pwm2_enable=2

The Super I/O is found at 0x2e, chip ID 0x8607, revision 2, and the
hardware monitor at 0xa40; ACPI reserves that range, hence the module
parameter. Is that acceptable, or would you prefer a DMI quirk for the
NUC6 boards?

 Documentation/hwmon/it87.rst | 16 +++++++++++++++-
 drivers/hwmon/Kconfig        |  4 ++--
 drivers/hwmon/it87.c         | 17 +++++++++++++++--
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/Documentation/hwmon/it87.rst b/Documentation/hwmon/it87.rst
index c33ba8a..17bfffb 100644
--- a/Documentation/hwmon/it87.rst
+++ b/Documentation/hwmon/it87.rst
@@ -19,6 +19,14 @@ Supported chips:
 
     Datasheet: Not publicly available
 
+  * IT8607E
+
+    Prefix: 'it8607'
+
+    Addresses scanned: from Super I/O config space (8 I/O ports)
+
+    Datasheet: Not publicly available
+
   * IT8620E
 
     Prefix: 'it8620'
@@ -243,7 +251,7 @@ motherboard models.
 Description
 -----------
 
-This driver implements support for the IT8603E, IT8620E, IT8623E, IT8628E,
+This driver implements support for the IT8603E, IT8607E, IT8620E, IT8623E, IT8628E,
 IT8689E, IT8705F, IT8712F, IT8716F, IT8718F, IT8720F, IT8721F, IT8726F,
 IT8728F, IT8732F, IT8758E, IT8771E, IT8772E, IT8781F, IT8782F, IT8783E/F,
 IT8786E, IT8790E, IT8792E/IT8795E, IT87952E and SiS950 chips.
@@ -287,6 +295,12 @@ The IT8603E/IT8623E is a custom design, hardware monitoring part is similar to
 IT8728F. It only supports 3 fans, 16-bit fan mode, and the full speed mode
 of the fan is not supported (value 0 of pwmX_enable).
 
+The IT8607E is found on the Intel NUC6i3SYB and NUC6i5SYB boards. The hardware
+monitoring part is treated as compatible with the IT8603E (16-bit fans, newer
+autopwm registers) because no datasheet is available. The BIOS keeps the
+environment controller hidden from ACPI, so the driver can only be loaded
+with ``ignore_resource_conflict=1``.
+
 The IT8620E and IT8628E are custom designs, hardware monitoring part is similar
 to IT8728F. It only supports 16-bit fan mode. Both chips support up to 6 fans.
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 18c682e..bc6ddff 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -952,8 +952,8 @@ config SENSORS_IT87
 	  If you say yes here you get support for ITE IT8705F, IT8712F, IT8716F,
 	  IT8718F, IT8720F, IT8721F, IT8726F, IT8728F, IT8732F, IT8758E,
 	  IT8771E, IT8772E, IT8781F, IT8782F, IT8783E/F, IT8786E, IT8790E,
-	  IT8603E, IT8620E, IT8623E, IT8628E, and IT8689E sensor chips, and
-	  the SiS950 clone.
+	  IT8603E, IT8607E, IT8620E, IT8623E, IT8628E, and IT8689E sensor chips,
+	  and the SiS950 clone.
 
 	  This driver can also be built as a module. If so, the module
 	  will be called it87.
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 2757d42..bdef0b7 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -12,6 +12,7 @@
  *  similar parts.  The other devices are supported by different drivers.
  *
  *  Supports: IT8603E  Super I/O chip w/LPC interface
+ *            IT8607E  Super I/O chip w/LPC interface
  *            IT8620E  Super I/O chip w/LPC interface
  *            IT8622E  Super I/O chip w/LPC interface
  *            IT8623E  Super I/O chip w/LPC interface
@@ -66,7 +67,7 @@
 
 enum chips { it87, it8712, it8716, it8718, it8720, it8721, it8728, it8732,
 	     it8771, it8772, it8781, it8782, it8783, it8786, it8790,
-	     it8792, it8603, it8613, it8620, it8622, it8628, it8689, it87952 };
+	     it8792, it8603, it8607, it8613, it8620, it8622, it8628, it8689, it87952 };
 
 static struct platform_device *it87_pdev[2];
 
@@ -160,6 +161,7 @@ static inline void superio_exit(int ioreg, bool noexit)
 #define IT8786E_DEVID 0x8786
 #define IT8790E_DEVID 0x8790
 #define IT8603E_DEVID 0x8603
+#define IT8607E_DEVID 0x8607
 #define IT8613E_DEVID 0x8613
 #define IT8620E_DEVID 0x8620
 #define IT8622E_DEVID 0x8622
@@ -530,6 +532,14 @@ static const struct it87_devices it87_devices[] = {
 		.num_temp_map = 6,
 		.peci_mask = 0x07,
 	},
+	[it8607] = {
+		.name = "it8607",
+		.model = "IT8607E",
+		.features = FEAT_NEWER_AUTOPWM | FEAT_12MV_ADC | FEAT_16BIT_FANS
+		  | FEAT_TEMP_OFFSET | FEAT_TEMP_PECI | FEAT_IN7_INTERNAL
+		  | FEAT_AVCC3 | FEAT_PWM_FREQ2,
+		.peci_mask = 0x07,
+	},
 	[it8620] = {
 		.name = "it8620",
 		.model = "IT8620E",
@@ -2941,6 +2951,9 @@ static int __init it87_find(int sioaddr, unsigned short *address,
 	case IT8613E_DEVID:
 		sio_data->type = it8613;
 		break;
+	case IT8607E_DEVID:
+		sio_data->type = it8607;
+		break;
 	case IT8620E_DEVID:
 		sio_data->type = it8620;
 		break;
@@ -3095,7 +3108,7 @@ static int __init it87_find(int sioaddr, unsigned short *address,
 
 		sio_data->beep_pin = superio_inb(sioaddr,
 						 IT87_SIO_BEEP_PIN_REG) & 0x3f;
-	} else if (sio_data->type == it8603) {
+	} else if (sio_data->type == it8603 || sio_data->type == it8607) {
 		int reg27, reg29;
 
 		superio_select(sioaddr, GPIO);
-- 
2.56.0

Re: [PATCH] hwmon: (it87) Add support for IT8607E

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] hwmon: (it87) NULL pointer dereference in it87_reg_pwm() due to missing reg_pwm
- [High] hwmon: (it87) broken PWM temp mapping for it8607 due to missing num_temp_map
--

commit fa2803179a2b666c8fd1b5211259f3072f2f691f
Author: Ismael Ojeda Perez <iojedaperez@proton.me>

hwmon: (it87) Add support for IT8607E

This commit adds hardware monitoring support for the ITE IT8607E Super I/O
chip found on Intel NUC6i3SYB and NUC6i5SYB boards, configuring its features
based on the IT8603E.

> diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
> index 2757d428a23db..bdef0b78332b7 100644
> --- a/drivers/hwmon/it87.c
> +++ b/drivers/hwmon/it87.c

[ ... ]

> @@ -530,6 +532,14 @@ static const struct it87_devices it87_devices[] = {
>  		.num_temp_map = 6,
>  		.peci_mask = 0x07,
>  	},
> +	[it8607] = {
> +		.name = "it8607",
> +		.model = "IT8607E",
> +		.features = FEAT_NEWER_AUTOPWM | FEAT_12MV_ADC | FEAT_16BIT_FANS
> +		  | FEAT_TEMP_OFFSET | FEAT_TEMP_PECI | FEAT_IN7_INTERNAL
> +		  | FEAT_AVCC3 | FEAT_PWM_FREQ2,
> +		.peci_mask = 0x07,
> +	},

[Severity: High]
Does the it8607 entry in it87_devices[] need to initialize .reg_pwm (such as
.reg_pwm = IT87_REG_PWM, as in it8603)?

Without .reg_pwm initialized, chip->reg_pwm is NULL and it87_probe() copies
that NULL pointer into data->reg_pwm:

drivers/hwmon/it87.c:it87_probe() {
    ...
    data->reg_pwm = chip->reg_pwm;
    ...
}

When any PWM channel is active in data->has_pwm (such as pwm2), reading any
hwmon sysfs attribute or running it87_resume() calls:

  it87_update_device()
    -> it87_update_pwm_ctrl()
      -> it87_reg_pwm(data, nr)

where it87_reg_pwm() dereferences data->reg_pwm[nr]:

static inline u16 it87_reg_pwm(const struct it87_data *data, int nr)
{
	return data->reg_pwm[nr];
}

Writing to pwmX, pwmX_enable, or pwmX_auto_channels_temp via set_pwm(),
set_pwm_enable(), or set_pwm_temp_map() also calls it87_reg_pwm() and will
dereference NULL.

[Severity: High]
Should the it8607 entry in it87_devices[] also initialize .num_temp_map (for
example, .num_temp_map = 4 to match it8603)?

Leaving .num_temp_map unset initializes data->num_temp_map to 0 in
it87_probe(). Because 0 != IT87_PWM_OLD_NUM_TEMP (3), uses_global_temp_map()
returns true:

static inline bool uses_global_temp_map(const struct it87_data *data)
{
	return has_new_tempmap(data) ||
		pwm_num_temp_map(data) != IT87_PWM_OLD_NUM_TEMP;
}

In it87_update_pwm_ctrl() and pwm_temp_channel(), the comparison against
pwm_num_temp_map(data) (0) is always true and resets data->pwm_temp_map[nr]
to 0:

	if (uses_global_temp_map(data) &&
	    data->pwm_temp_map[nr] >= pwm_num_temp_map(data))
		data->pwm_temp_map[nr] = 0;

Similarly, in pwm_temp_map_from_channel(), channel >= num (where num is 0) is
always true for unsigned int channel, causing all writes to
pwmX_auto_channels_temp via set_pwm_temp_map() to fail with -EINVAL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179357707375.834227.595814448085536071@proton.me?part=1