--- /dev/null
+From e2a1634c55a27531a90f3818279d5efc9608037f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 15:45:52 -0600
+Subject: hwmon: (tmp513) Fix division of negative numbers
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit e2c68cea431d65292b592c9f8446c918d45fcf78 ]
+
+Fix several issues with division of negative numbers in the tmp513
+driver.
+
+The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative
+value by an unsigned type is undefined behavior. The driver was doing
+this in several places, i.e. data->shunt_uohms has type of u32. The
+actual "undefined" behavior is that it converts both values to unsigned
+before doing the division, for example:
+
+ int ret = DIV_ROUND_CLOSEST(-100, 3U);
+
+results in ret == 1431655732 instead of -33.
+
+Furthermore the MILLI macro has a type of unsigned long. Multiplying a
+signed long by an unsigned long results in an unsigned long.
+
+So, we need to cast both MILLI and data data->shunt_uohms to long when
+using the DIV_ROUND_CLOSEST macro.
+
+Fixes: f07f9d2467f4 ("hwmon: (tmp513) Use SI constants from units.h")
+Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://lore.kernel.org/r/20250114-fix-si-prefix-macro-sign-bugs-v1-1-696fd8d10f00@baylibre.com
+[groeck: Drop some continuation lines]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tmp513.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
+index aaba9521ebefe..cbe29c8a9b18d 100644
+--- a/drivers/hwmon/tmp513.c
++++ b/drivers/hwmon/tmp513.c
+@@ -203,7 +203,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
+ *val = sign_extend32(regval,
+ reg == TMP51X_SHUNT_CURRENT_RESULT ?
+ 16 - tmp51x_get_pga_shift(data) : 15);
+- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms);
++ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms);
++
+ break;
+ case TMP51X_BUS_VOLTAGE_RESULT:
+ case TMP51X_BUS_VOLTAGE_H_LIMIT:
+@@ -219,7 +220,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
+ case TMP51X_BUS_CURRENT_RESULT:
+ // Current = (ShuntVoltage * CalibrationRegister) / 4096
+ *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua;
+- *val = DIV_ROUND_CLOSEST(*val, MILLI);
++ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI);
+ break;
+ case TMP51X_LOCAL_TEMP_RESULT:
+ case TMP51X_REMOTE_TEMP_RESULT_1:
+@@ -259,7 +260,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val)
+ * The user enter current value and we convert it to
+ * voltage. 1lsb = 10uV
+ */
+- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI);
++ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI);
+ max_val = U16_MAX >> tmp51x_get_pga_shift(data);
+ regval = clamp_val(val, -max_val, max_val);
+ break;
+--
+2.39.5
+
--- /dev/null
+From e6483cbd8f91a0181e9b51113ab0927306f2a3d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 08:29:45 +0100
+Subject: i2c: mux: demux-pinctrl: check initial mux selection, too
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit ca89f73394daf92779ddaa37b42956f4953f3941 ]
+
+When misconfigured, the initial setup of the current mux channel can
+fail, too. It must be checked as well.
+
+Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 45a3f7e7b3f68..cea057704c00c 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ pm_runtime_no_callbacks(&pdev->dev);
+
+ /* switch to first parent as active master */
+- i2c_demux_activate_master(priv, 0);
++ err = i2c_demux_activate_master(priv, 0);
++ if (err)
++ goto err_rollback;
+
+ err = device_create_file(&pdev->dev, &dev_attr_available_masters);
+ if (err)
+--
+2.39.5
+
--- /dev/null
+From e1515ecb75b454adfd9fafa809db95d082eed18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 13:36:23 +0100
+Subject: i2c: rcar: fix NACK handling when being a target
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 093f70c134f70e4632b295240f07d2b50b74e247 ]
+
+When this controller is a target, the NACK handling had two issues.
+First, the return value from the backend was not checked on the initial
+WRITE_REQUESTED. So, the driver missed to send a NACK in this case.
+Also, the NACK always arrives one byte late on the bus, even in the
+WRITE_RECEIVED case. This seems to be a HW issue. We should then not
+rely on the backend to correctly NACK the superfluous byte as well. Fix
+both issues by introducing a flag which gets set whenever the backend
+requests a NACK and keep sending it until we get a STOP condition.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 316dd378fb8c4..afefe99129001 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -112,6 +112,8 @@
+ #define ID_P_PM_BLOCKED BIT(31)
+ #define ID_P_MASK GENMASK(31, 28)
+
++#define ID_SLAVE_NACK BIT(0)
++
+ enum rcar_i2c_type {
+ I2C_RCAR_GEN1,
+ I2C_RCAR_GEN2,
+@@ -146,6 +148,7 @@ struct rcar_i2c_priv {
+ int irq;
+
+ struct i2c_client *host_notify_client;
++ u8 slave_flags;
+ };
+
+ #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent)
+@@ -576,6 +579,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ {
+ u32 ssr_raw, ssr_filtered;
+ u8 value;
++ int ret;
+
+ ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff;
+ ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER);
+@@ -591,7 +595,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ rcar_i2c_write(priv, ICRXTX, value);
+ rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR);
+ } else {
+- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
++ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
++ if (ret)
++ priv->slave_flags |= ID_SLAVE_NACK;
++
+ rcar_i2c_read(priv, ICRXTX); /* dummy read */
+ rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
+ }
+@@ -604,18 +611,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
++ priv->slave_flags &= ~ID_SLAVE_NACK;
+ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+
+ /* master wants to write to us */
+ if (ssr_filtered & SDR) {
+- int ret;
+-
+ value = rcar_i2c_read(priv, ICRXTX);
+ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value);
+- /* Send NACK in case of error */
+- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0));
++ if (ret)
++ priv->slave_flags |= ID_SLAVE_NACK;
++
++ /* Send NACK in case of error, but it will come 1 byte late :( */
++ rcar_i2c_write(priv, ICSCR, SIE | SDBS |
++ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0));
+ rcar_i2c_write(priv, ICSSR, ~SDR & 0xff);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b7f45ec59f2ffa1d073778385c9543a3d8b0ac67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 13:41:56 +0000
+Subject: Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
+
+From: Pratyush Yadav <pratyush@kernel.org>
+
+[ Upstream commit d15638bf76ad47874ecb5dc386f0945fc0b2a875 ]
+
+This reverts commit 98d1fb94ce75f39febd456d6d3cbbe58b6678795.
+
+The commit uses data nbits instead of addr nbits for dummy phase. This
+causes a regression for all boards where spi-tx-bus-width is smaller
+than spi-rx-bus-width. It is a common pattern for boards to have
+spi-tx-bus-width == 1 and spi-rx-bus-width > 1. The regression causes
+all reads with a dummy phase to become unavailable for such boards,
+leading to a usually slower 0-dummy-cycle read being selected.
+
+Most controllers' supports_op hooks call spi_mem_default_supports_op().
+In spi_mem_default_supports_op(), spi_mem_check_buswidth() is called to
+check if the buswidths for the op can actually be supported by the
+board's wiring. This wiring information comes from (among other things)
+the spi-{tx,rx}-bus-width DT properties. Based on these properties,
+SPI_TX_* or SPI_RX_* flags are set by of_spi_parse_dt().
+spi_mem_check_buswidth() then uses these flags to make the decision
+whether an op can be supported by the board's wiring (in a way,
+indirectly checking against spi-{rx,tx}-bus-width).
+
+Now the tricky bit here is that spi_mem_check_buswidth() does:
+
+ if (op->dummy.nbytes &&
+ spi_check_buswidth_req(mem, op->dummy.buswidth, true))
+ return false;
+
+The true argument to spi_check_buswidth_req() means the op is treated as
+a TX op. For a board that has say 1-bit TX and 4-bit RX, a 4-bit dummy
+TX is considered as unsupported, and the op gets rejected.
+
+The commit being reverted uses the data buswidth for dummy buswidth. So
+for reads, the RX buswidth gets used for the dummy phase, uncovering
+this issue. In reality, a dummy phase is neither RX nor TX. As the name
+suggests, these are just dummy cycles that send or receive no data, and
+thus don't really need to have any buswidth at all.
+
+Ideally, dummy phases should not be checked against the board's wiring
+capabilities at all, and should only be sanity-checked for having a sane
+buswidth value. Since we are now at rc7 and such a change might
+introduce many unexpected bugs, revert the commit for now. It can be
+sent out later along with the spi_mem_check_buswidth() fix.
+
+Fixes: 98d1fb94ce75 ("mtd: spi-nor: core: replace dummy buswidth from addr to data")
+Reported-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Closes: https://lore.kernel.org/linux-mtd/3342163.44csPzL39Z@steina-w/
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
+index 4e66354b87f37..e115aab7243e1 100644
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor,
+ op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+
+ if (op->dummy.nbytes)
+- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto);
++ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+
+ if (op->data.nbytes)
+ op->data.buswidth = spi_nor_get_protocol_data_nbits(proto);
+--
+2.39.5
+
net-mlx5-refactor-mlx5_get_flow_namespace.patch
net-mlx5-fix-rdma-tx-steering-prio.patch
drm-v3d-ensure-job-pointer-is-set-to-null-after-job-.patch
+hwmon-tmp513-fix-division-of-negative-numbers.patch
+revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch
+i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch
+i2c-rcar-fix-nack-handling-when-being-a-target.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
