[RFT PATCH 0/3] hwmon: (nct6775) Fix target temperature and tolerance handling

[RFT PATCH 0/3] hwmon: (nct6775) Fix target temperature and tolerance handling

[Guenter Roeck]

From: Guenter Roeck <groeck@google.com>

This series fixes three bugs in fan target temperature and tolerance
handling in the nct6775 driver:

- Patch 1 initializes target_temp_mask, tolerance_mask, and
  speed_tolerance_limit for NCT6106, NCT6116, and NCT6126 in
  nct6775_probe() so pwm*_target_temp and the tolerance attributes do
  not read or clamp to 0 and REG_FAN_MODE tolerance bits are cleared on
  updates.
- Patch 2 fixes the inverted index check in store_temp_tolerance() so
  writes to pwm*_temp_tolerance update REG_FAN_MODE and writes to
  pwm*_crit_temp_tolerance update REG_CRITICAL_TEMP_TOLERANCE instead of
  each writing the other's register.
- Patch 3 masks fanmodecfg with data->tolerance_mask instead of a
  hardcoded 0x0f in nct6775_update_pwm() so bit 3 of REG_FAN_MODE does
  not leak into cached tolerance values on chips with a 3-bit tolerance
  field.

Disclosure per Documentation/process/generated-content.rst:
Patch 1 was reported by Sashiko
(https://sashiko.dev/#/bug/linux-76f191d0-4c79-4982-887e-e5c9a2ed7136),
and patches 2 and 3 were flagged as pre-existing concerns by local
sashiko review while reviewing patch 1. An AI coding assistant (Gemini)
was prompted to investigate and fix the Sashiko report, fix the two
additional issues reported by Sashiko, and write this cover letter; it
generated the code changes, commit messages, and cover letter text. The
series was build-tested on x86_64 with W=1, verified under User-Mode
Linux (ARCH=um) using an out-of-tree simulated regmap test module
exercising the affected sysfs attributes and register values (not tested
on physical hardware), and checked with scripts/checkpatch.pl and
sashiko review.

I don't have hardware to test the patches, therefore I am submitting them
as RFT.

Guenter Roeck (3):
  hwmon: (nct6775) Fix target temp and tolerance for NCT6106/6116/6126
  hwmon: (nct6775) Fix swapped temperature tolerance register writes
  hwmon: (nct6775) Fix tolerance bitmask when reading REG_FAN_MODE

 drivers/hwmon/nct6775-core.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

-- 
2.56.0

[RFT PATCH 1/3] hwmon: (nct6775) Fix target temp and tolerance for NCT6106/6116/6126

[Guenter Roeck]

In nct6775_probe(), the nct6106, nct6116, and nct6126 chip cases leave
target_temp_mask, tolerance_mask, and speed_tolerance_limit
zero-initialized.

As a result, reading pwm*_target_temp from sysfs always returns 0,
writing to pwm*_target_temp, pwm*_temp_tolerance,
pwm*_crit_temp_tolerance, or fan*_tolerance clamps user-supplied values
to 0, and pwm_update_registers() fails to clear existing tolerance bits
in REG_FAN_MODE when updating fan control modes.

Initialize target_temp_mask to 0xff, tolerance_mask to 0x07, and
speed_tolerance_limit to 63 for NCT6106, NCT6116, and NCT6126, matching
the hardware register layout shared with NCT5525 and NCT6776+.

Fixes: 6c009501ff20 ("hwmon: (nct6775) Add support for NCT6102D/6106D")
Fixes: 29c7cb485b32 ("hwmon: (nct6775) Integrate new model nct6116")
Fixes: 437b3c2a4bdc ("hwmon: (nct6775) Add support for NCT6126D")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/bug/linux-76f191d0-4c79-4982-887e-e5c9a2ed7136
Cc: Anton Lundin <glance@ac2.se>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/nct6775-core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 83083a0e9302..192b52750db5 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -3712,6 +3712,9 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
 
 		data->fan_from_reg = fan_from_reg13;
 		data->fan_from_reg_min = fan_from_reg13;
+		data->target_temp_mask = 0xff;
+		data->tolerance_mask = 0x07;
+		data->speed_tolerance_limit = 63;
 
 		data->temp_label = nct6776_temp_label;
 		data->temp_mask = NCT6776_TEMP_MASK;
@@ -3788,6 +3791,9 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
 
 		data->fan_from_reg = fan_from_reg13;
 		data->fan_from_reg_min = fan_from_reg13;
+		data->target_temp_mask = 0xff;
+		data->tolerance_mask = 0x07;
+		data->speed_tolerance_limit = 63;
 
 		data->temp_label = nct6776_temp_label;
 		data->temp_mask = NCT6776_TEMP_MASK;
@@ -3865,6 +3871,9 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
 
 		data->fan_from_reg = fan_from_reg13;
 		data->fan_from_reg_min = fan_from_reg13;
+		data->target_temp_mask = 0xff;
+		data->tolerance_mask = 0x07;
+		data->speed_tolerance_limit = 63;
 
 		data->temp_label = nct6776_temp_label;
 		data->temp_mask = NCT6776_TEMP_MASK;
-- 
2.45.2

[RFT PATCH 2/3] hwmon: (nct6775) Fix swapped temperature tolerance register writes

[Guenter Roeck]

sensor_dev_template_pwm_temp_tolerance uses index 0 (backed by
REG_FAN_MODE via pwm_update_registers()) while
sensor_dev_template_pwm_crit_temp_tolerance uses index 1 (backed by
REG_CRITICAL_TEMP_TOLERANCE). However, store_temp_tolerance() checks
if (index) with inverted branches.

As a result, writing to pwm*_temp_tolerance writes the new tolerance to
REG_CRITICAL_TEMP_TOLERANCE instead of REG_FAN_MODE, while writing to
pwm*_crit_temp_tolerance updates REG_FAN_MODE with temp_tolerance[0] and
leaves REG_CRITICAL_TEMP_TOLERANCE unchanged.

Invert the index check in store_temp_tolerance() so index 0 updates fan
mode registers via pwm_update_registers() and index 1 writes to
REG_CRITICAL_TEMP_TOLERANCE.

Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev
Cc: Anton Lundin <glance@ac2.se>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/nct6775-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 192b52750db5..1d63747a2f38 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -3053,7 +3053,7 @@ store_temp_tolerance(struct device *dev, struct device_attribute *attr,
 
 	mutex_lock(&data->update_lock);
 	data->temp_tolerance[index][nr] = val;
-	if (index)
+	if (!index)
 		err = pwm_update_registers(data, nr);
 	else
 		err = nct6775_write_value(data, data->REG_CRITICAL_TEMP_TOLERANCE[nr], val);
-- 
2.45.2

[RFT PATCH 3/3] hwmon: (nct6775) Fix tolerance bitmask when reading REG_FAN_MODE

[Guenter Roeck]

On NCT6775, bits 0..3 of REG_FAN_MODE hold the temperature or fan speed
tolerance (tolerance_mask is 0x0f), whereas on NCT5525, NCT6106,
NCT6116, NCT6126, and NCT6776+, only bits 0..2 hold the temperature
tolerance or low 3 bits of speed tolerance (tolerance_mask is 0x07).
However, nct6775_update_pwm() masks fanmodecfg with a hardcoded 0x0f.

When bit 3 of REG_FAN_MODE is set on chips where tolerance_mask is 0x07,
nct6775_update_pwm() includes bit 3 in temp_tolerance[0] and
target_speed_tolerance, corrupting reported tolerance values and causing
pwm_update_registers() to OR bit 3 back into REG_FAN_MODE.

Mask fanmodecfg with data->tolerance_mask instead of 0x0f in
nct6775_update_pwm().

Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev
Cc: Anton Lundin <glance@ac2.se>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/nct6775-core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
index 1d63747a2f38..ff7f7468185d 100644
--- a/drivers/hwmon/nct6775-core.c
+++ b/drivers/hwmon/nct6775-core.c
@@ -1510,10 +1510,10 @@ static int nct6775_update_pwm(struct device *dev)
 
 		if (!data->temp_tolerance[0][i] ||
 		    data->pwm_enable[i] != speed_cruise)
-			data->temp_tolerance[0][i] = fanmodecfg & 0x0f;
+			data->temp_tolerance[0][i] = fanmodecfg & data->tolerance_mask;
 		if (!data->target_speed_tolerance[i] ||
 		    data->pwm_enable[i] == speed_cruise) {
-			u8 t = fanmodecfg & 0x0f;
+			u8 t = fanmodecfg & data->tolerance_mask;
 
 			if (data->REG_TOLERANCE_H) {
 				err = nct6775_read_value(data, data->REG_TOLERANCE_H[i], &reg);
-- 
2.45.2

Re: [RFT PATCH 1/3] hwmon: (nct6775) Fix target temp and tolerance for NCT6106/6116/6126

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] hwmon: (nct6775) REG_TARGET marked word-sized in
  nct6775_reg_is_word_sized()
--

commit 7460f66a45ab993c8409879e58f676a24f6e5ad1
Author: Guenter Roeck <linux@roeck-us.net>

hwmon: (nct6775) Fix target temp and tolerance for NCT6106/6116/6126

This commit initializes target_temp_mask, tolerance_mask, and
speed_tolerance_limit for NCT6106, NCT6116, and NCT6126 in nct6775_probe().

Link: https://sashiko.dev/#/bug/linux-76f191d0-4c79-4982-887e-e5c9a2ed7136

> diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
> index 6e97e4f08b90b..9340525689cff 100644
> --- a/drivers/hwmon/nct6775-core.c
> +++ b/drivers/hwmon/nct6775-core.c
> @@ -3574,6 +3574,9 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
>  
>  		data->fan_from_reg = fan_from_reg13;
>  		data->fan_from_reg_min = fan_from_reg13;
> +		data->target_temp_mask = 0xff;
> +		data->tolerance_mask = 0x07;
> +		data->speed_tolerance_limit = 63;

[Severity: High]
Does setting target_temp_mask to 0xff expose that REG_TARGET (0x111, 0x121,
0x131, and 0x191, 0x1a1 on nct6116/nct6126) is marked word-sized in
nct6775_reg_is_word_sized()?

drivers/hwmon/nct6775-core.c:nct6775_reg_is_word_sized() {
	...
	case nct6106:
		return reg == 0x20 || reg == 0x22 || reg == 0x24 ||
		  (reg >= 0x59 && reg < 0x69 && (reg & 1)) ||
		  reg == 0xe0 || reg == 0xe2 || reg == 0xe4 ||
		  reg == 0x111 || reg == 0x121 || reg == 0x131;
	case nct6116:
	case nct6126:
		return reg == 0x20 || reg == 0x22 || reg == 0x24 ||
		  reg == 0x26 || reg == 0x28 || reg == 0x59 || reg == 0x5b ||
		  reg == 0xe0 || reg == 0xe2 || reg == 0xe4 || reg == 0xe6 ||
		  reg == 0xe8 || reg == 0x111 || reg == 0x121 || reg == 0x131 ||
		  reg == 0x191 || reg == 0x1a1;
	...
}

Because nct6775_reg_is_word_sized() returns true for REG_TARGET, a read via
nct6775_read_value() performs a 16-bit big-endian read across REG_TARGET
(placed in bits 15:8) and the adjacent REG_TOLERANCE_H at reg + 1 (placed in
bits 7:0).  In nct6775_update_pwm_limits(), masking reg_t with
target_temp_mask (0xff) then discards REG_TARGET and stores REG_TOLERANCE_H
into data->target_temp[i], while also corrupting data->target_speed[i] in
speed_cruise mode.

When writing pwm*_target_temp in thermal_cruise mode, pwm_update_registers()
passes the 8-bit data->target_temp[nr] to nct6775_write_value(), which writes
0x00 (value >> 8) to REG_TARGET and overwrites REG_TOLERANCE_H with
target_temp[nr].  Should 0x111, 0x121, 0x131, 0x191, and 0x1a1 be removed from
nct6775_reg_is_word_sized()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110035955.3968731-1-linux@roeck-us.net?part=1

Re: [RFT PATCH 2/3] hwmon: (nct6775) Fix swapped temperature tolerance register writes

[sashiko-bot]

> sensor_dev_template_pwm_temp_tolerance uses index 0 (backed by
> REG_FAN_MODE via pwm_update_registers()) while
> sensor_dev_template_pwm_crit_temp_tolerance uses index 1 (backed by
> REG_CRITICAL_TEMP_TOLERANCE). However, store_temp_tolerance() checks
> if (index) with inverted branches.
> 
> As a result, writing to pwm*_temp_tolerance writes the new tolerance to
> REG_CRITICAL_TEMP_TOLERANCE instead of REG_FAN_MODE, while writing to
> pwm*_crit_temp_tolerance updates REG_FAN_MODE with temp_tolerance[0] and
> leaves REG_CRITICAL_TEMP_TOLERANCE unchanged.
> 
> Invert the index check in store_temp_tolerance() so index 0 updates fan
> mode registers via pwm_update_registers() and index 1 writes to
> REG_CRITICAL_TEMP_TOLERANCE.
> 
> Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://sashiko.dev
> Cc: Anton Lundin <glance@ac2.se>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110035955.3968731-1-linux@roeck-us.net?part=2

Re: [RFT PATCH 3/3] hwmon: (nct6775) Fix tolerance bitmask when reading REG_FAN_MODE

[sashiko-bot]

> On NCT6775, bits 0..3 of REG_FAN_MODE hold the temperature or fan speed
> tolerance (tolerance_mask is 0x0f), whereas on NCT5525, NCT6106,
> NCT6116, NCT6126, and NCT6776+, only bits 0..2 hold the temperature
> tolerance or low 3 bits of speed tolerance (tolerance_mask is 0x07).
> However, nct6775_update_pwm() masks fanmodecfg with a hardcoded 0x0f.
> 
> When bit 3 of REG_FAN_MODE is set on chips where tolerance_mask is 0x07,
> nct6775_update_pwm() includes bit 3 in temp_tolerance[0] and
> target_speed_tolerance, corrupting reported tolerance values and causing
> pwm_update_registers() to OR bit 3 back into REG_FAN_MODE.
> 
> Mask fanmodecfg with data->tolerance_mask instead of 0x0f in
> nct6775_update_pwm().
> 
> Fixes: cdcaeceb74ff ("hwmon: (nct6775) Add support for automatic fan control")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://sashiko.dev
> Cc: Anton Lundin <glance@ac2.se>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110035955.3968731-1-linux@roeck-us.net?part=3

Re: [RFT PATCH 1/3] hwmon: (nct6775) Fix target temp and tolerance for NCT6106/6116/6126

[Guenter Roeck]

On 11/9/26 20:15, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [High] hwmon: (nct6775) REG_TARGET marked word-sized in
>    nct6775_reg_is_word_sized()

Unless I am  missing something, this should be fixed with
"hwmon: (nct6775) Handle dual use registers".

Guenter

> --
> 
> commit 7460f66a45ab993c8409879e58f676a24f6e5ad1
> Author: Guenter Roeck <linux@roeck-us.net>
> 
> hwmon: (nct6775) Fix target temp and tolerance for NCT6106/6116/6126
> 
> This commit initializes target_temp_mask, tolerance_mask, and
> speed_tolerance_limit for NCT6106, NCT6116, and NCT6126 in nct6775_probe().
> 
> Link: https://sashiko.dev/#/bug/linux-76f191d0-4c79-4982-887e-e5c9a2ed7136
> 
>> diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
>> index 6e97e4f08b90b..9340525689cff 100644
>> --- a/drivers/hwmon/nct6775-core.c
>> +++ b/drivers/hwmon/nct6775-core.c
>> @@ -3574,6 +3574,9 @@ int nct6775_probe(struct device *dev, struct nct6775_data *data,
>>   
>>   		data->fan_from_reg = fan_from_reg13;
>>   		data->fan_from_reg_min = fan_from_reg13;
>> +		data->target_temp_mask = 0xff;
>> +		data->tolerance_mask = 0x07;
>> +		data->speed_tolerance_limit = 63;
> 
> [Severity: High]
> Does setting target_temp_mask to 0xff expose that REG_TARGET (0x111, 0x121,
> 0x131, and 0x191, 0x1a1 on nct6116/nct6126) is marked word-sized in
> nct6775_reg_is_word_sized()?
> 
> drivers/hwmon/nct6775-core.c:nct6775_reg_is_word_sized() {
> 	...
> 	case nct6106:
> 		return reg == 0x20 || reg == 0x22 || reg == 0x24 ||
> 		  (reg >= 0x59 && reg < 0x69 && (reg & 1)) ||
> 		  reg == 0xe0 || reg == 0xe2 || reg == 0xe4 ||
> 		  reg == 0x111 || reg == 0x121 || reg == 0x131;
> 	case nct6116:
> 	case nct6126:
> 		return reg == 0x20 || reg == 0x22 || reg == 0x24 ||
> 		  reg == 0x26 || reg == 0x28 || reg == 0x59 || reg == 0x5b ||
> 		  reg == 0xe0 || reg == 0xe2 || reg == 0xe4 || reg == 0xe6 ||
> 		  reg == 0xe8 || reg == 0x111 || reg == 0x121 || reg == 0x131 ||
> 		  reg == 0x191 || reg == 0x1a1;
> 	...
> }
> 
> Because nct6775_reg_is_word_sized() returns true for REG_TARGET, a read via
> nct6775_read_value() performs a 16-bit big-endian read across REG_TARGET
> (placed in bits 15:8) and the adjacent REG_TOLERANCE_H at reg + 1 (placed in
> bits 7:0).  In nct6775_update_pwm_limits(), masking reg_t with
> target_temp_mask (0xff) then discards REG_TARGET and stores REG_TOLERANCE_H
> into data->target_temp[i], while also corrupting data->target_speed[i] in
> speed_cruise mode.
> 
> When writing pwm*_target_temp in thermal_cruise mode, pwm_update_registers()
> passes the 8-bit data->target_temp[nr] to nct6775_write_value(), which writes
> 0x00 (value >> 8) to REG_TARGET and overwrites REG_TOLERANCE_H with
> target_temp[nr].  Should 0x111, 0x121, 0x131, 0x191, and 0x1a1 be removed from
> nct6775_reg_is_word_sized()?
>