From: Sasha Levin Date: Sat, 18 Jan 2025 22:25:54 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v6.1.126~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1f824afde7c56ff2653e2186034ab82c04d0a80e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/hwmon-tmp513-fix-division-of-negative-numbers.patch b/queue-5.15/hwmon-tmp513-fix-division-of-negative-numbers.patch new file mode 100644 index 0000000000..11330afd16 --- /dev/null +++ b/queue-5.15/hwmon-tmp513-fix-division-of-negative-numbers.patch @@ -0,0 +1,74 @@ +From e2a1634c55a27531a90f3818279d5efc9608037f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 15:45:52 -0600 +Subject: hwmon: (tmp513) Fix division of negative numbers + +From: David Lechner + +[ Upstream commit e2c68cea431d65292b592c9f8446c918d45fcf78 ] + +Fix several issues with division of negative numbers in the tmp513 +driver. + +The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative +value by an unsigned type is undefined behavior. The driver was doing +this in several places, i.e. data->shunt_uohms has type of u32. The +actual "undefined" behavior is that it converts both values to unsigned +before doing the division, for example: + + int ret = DIV_ROUND_CLOSEST(-100, 3U); + +results in ret == 1431655732 instead of -33. + +Furthermore the MILLI macro has a type of unsigned long. Multiplying a +signed long by an unsigned long results in an unsigned long. + +So, we need to cast both MILLI and data data->shunt_uohms to long when +using the DIV_ROUND_CLOSEST macro. + +Fixes: f07f9d2467f4 ("hwmon: (tmp513) Use SI constants from units.h") +Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.") +Signed-off-by: David Lechner +Link: https://lore.kernel.org/r/20250114-fix-si-prefix-macro-sign-bugs-v1-1-696fd8d10f00@baylibre.com +[groeck: Drop some continuation lines] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/tmp513.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c +index aaba9521ebefe..cbe29c8a9b18d 100644 +--- a/drivers/hwmon/tmp513.c ++++ b/drivers/hwmon/tmp513.c +@@ -203,7 +203,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, + *val = sign_extend32(regval, + reg == TMP51X_SHUNT_CURRENT_RESULT ? + 16 - tmp51x_get_pga_shift(data) : 15); +- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms); ++ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms); ++ + break; + case TMP51X_BUS_VOLTAGE_RESULT: + case TMP51X_BUS_VOLTAGE_H_LIMIT: +@@ -219,7 +220,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, + case TMP51X_BUS_CURRENT_RESULT: + // Current = (ShuntVoltage * CalibrationRegister) / 4096 + *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua; +- *val = DIV_ROUND_CLOSEST(*val, MILLI); ++ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI); + break; + case TMP51X_LOCAL_TEMP_RESULT: + case TMP51X_REMOTE_TEMP_RESULT_1: +@@ -259,7 +260,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val) + * The user enter current value and we convert it to + * voltage. 1lsb = 10uV + */ +- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI); ++ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI); + max_val = U16_MAX >> tmp51x_get_pga_shift(data); + regval = clamp_val(val, -max_val, max_val); + break; +-- +2.39.5 + diff --git a/queue-5.15/i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch b/queue-5.15/i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch new file mode 100644 index 0000000000..22e98e7bbb --- /dev/null +++ b/queue-5.15/i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch @@ -0,0 +1,37 @@ +From e6483cbd8f91a0181e9b51113ab0927306f2a3d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 08:29:45 +0100 +Subject: i2c: mux: demux-pinctrl: check initial mux selection, too + +From: Wolfram Sang + +[ Upstream commit ca89f73394daf92779ddaa37b42956f4953f3941 ] + +When misconfigured, the initial setup of the current mux channel can +fail, too. It must be checked as well. + +Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver") +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 45a3f7e7b3f68..cea057704c00c 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + pm_runtime_no_callbacks(&pdev->dev); + + /* switch to first parent as active master */ +- i2c_demux_activate_master(priv, 0); ++ err = i2c_demux_activate_master(priv, 0); ++ if (err) ++ goto err_rollback; + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +-- +2.39.5 + diff --git a/queue-5.15/i2c-rcar-fix-nack-handling-when-being-a-target.patch b/queue-5.15/i2c-rcar-fix-nack-handling-when-being-a-target.patch new file mode 100644 index 0000000000..5e1e14cf73 --- /dev/null +++ b/queue-5.15/i2c-rcar-fix-nack-handling-when-being-a-target.patch @@ -0,0 +1,95 @@ +From e1515ecb75b454adfd9fafa809db95d082eed18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 13:36:23 +0100 +Subject: i2c: rcar: fix NACK handling when being a target + +From: Wolfram Sang + +[ Upstream commit 093f70c134f70e4632b295240f07d2b50b74e247 ] + +When this controller is a target, the NACK handling had two issues. +First, the return value from the backend was not checked on the initial +WRITE_REQUESTED. So, the driver missed to send a NACK in this case. +Also, the NACK always arrives one byte late on the bus, even in the +WRITE_RECEIVED case. This seems to be a HW issue. We should then not +rely on the backend to correctly NACK the superfluous byte as well. Fix +both issues by introducing a flag which gets set whenever the backend +requests a NACK and keep sending it until we get a STOP condition. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 316dd378fb8c4..afefe99129001 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -112,6 +112,8 @@ + #define ID_P_PM_BLOCKED BIT(31) + #define ID_P_MASK GENMASK(31, 28) + ++#define ID_SLAVE_NACK BIT(0) ++ + enum rcar_i2c_type { + I2C_RCAR_GEN1, + I2C_RCAR_GEN2, +@@ -146,6 +148,7 @@ struct rcar_i2c_priv { + int irq; + + struct i2c_client *host_notify_client; ++ u8 slave_flags; + }; + + #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent) +@@ -576,6 +579,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + { + u32 ssr_raw, ssr_filtered; + u8 value; ++ int ret; + + ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff; + ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER); +@@ -591,7 +595,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + rcar_i2c_write(priv, ICRXTX, value); + rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR); + } else { +- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); ++ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); ++ if (ret) ++ priv->slave_flags |= ID_SLAVE_NACK; ++ + rcar_i2c_read(priv, ICRXTX); /* dummy read */ + rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); + } +@@ -604,18 +611,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); + rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ ++ priv->slave_flags &= ~ID_SLAVE_NACK; + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } + + /* master wants to write to us */ + if (ssr_filtered & SDR) { +- int ret; +- + value = rcar_i2c_read(priv, ICRXTX); + ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value); +- /* Send NACK in case of error */ +- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0)); ++ if (ret) ++ priv->slave_flags |= ID_SLAVE_NACK; ++ ++ /* Send NACK in case of error, but it will come 1 byte late :( */ ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS | ++ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0)); + rcar_i2c_write(priv, ICSSR, ~SDR & 0xff); + } + +-- +2.39.5 + diff --git a/queue-5.15/revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch b/queue-5.15/revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch new file mode 100644 index 0000000000..52edc89dda --- /dev/null +++ b/queue-5.15/revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch @@ -0,0 +1,78 @@ +From b7f45ec59f2ffa1d073778385c9543a3d8b0ac67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 13:41:56 +0000 +Subject: Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data" + +From: Pratyush Yadav + +[ Upstream commit d15638bf76ad47874ecb5dc386f0945fc0b2a875 ] + +This reverts commit 98d1fb94ce75f39febd456d6d3cbbe58b6678795. + +The commit uses data nbits instead of addr nbits for dummy phase. This +causes a regression for all boards where spi-tx-bus-width is smaller +than spi-rx-bus-width. It is a common pattern for boards to have +spi-tx-bus-width == 1 and spi-rx-bus-width > 1. The regression causes +all reads with a dummy phase to become unavailable for such boards, +leading to a usually slower 0-dummy-cycle read being selected. + +Most controllers' supports_op hooks call spi_mem_default_supports_op(). +In spi_mem_default_supports_op(), spi_mem_check_buswidth() is called to +check if the buswidths for the op can actually be supported by the +board's wiring. This wiring information comes from (among other things) +the spi-{tx,rx}-bus-width DT properties. Based on these properties, +SPI_TX_* or SPI_RX_* flags are set by of_spi_parse_dt(). +spi_mem_check_buswidth() then uses these flags to make the decision +whether an op can be supported by the board's wiring (in a way, +indirectly checking against spi-{rx,tx}-bus-width). + +Now the tricky bit here is that spi_mem_check_buswidth() does: + + if (op->dummy.nbytes && + spi_check_buswidth_req(mem, op->dummy.buswidth, true)) + return false; + +The true argument to spi_check_buswidth_req() means the op is treated as +a TX op. For a board that has say 1-bit TX and 4-bit RX, a 4-bit dummy +TX is considered as unsupported, and the op gets rejected. + +The commit being reverted uses the data buswidth for dummy buswidth. So +for reads, the RX buswidth gets used for the dummy phase, uncovering +this issue. In reality, a dummy phase is neither RX nor TX. As the name +suggests, these are just dummy cycles that send or receive no data, and +thus don't really need to have any buswidth at all. + +Ideally, dummy phases should not be checked against the board's wiring +capabilities at all, and should only be sanity-checked for having a sane +buswidth value. Since we are now at rc7 and such a change might +introduce many unexpected bugs, revert the commit for now. It can be +sent out later along with the spi_mem_check_buswidth() fix. + +Fixes: 98d1fb94ce75 ("mtd: spi-nor: core: replace dummy buswidth from addr to data") +Reported-by: Alexander Stein +Closes: https://lore.kernel.org/linux-mtd/3342163.44csPzL39Z@steina-w/ +Tested-by: Alexander Stein +Reviewed-by: Tudor Ambarus +Signed-off-by: Pratyush Yadav +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index 4e66354b87f37..e115aab7243e1 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor, + op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto); + + if (op->dummy.nbytes) +- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto); ++ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto); + + if (op->data.nbytes) + op->data.buswidth = spi_nor_get_protocol_data_nbits(proto); +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series index a4dd451542..84c631844f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -89,3 +89,7 @@ net-mlx5-add-priorities-for-counters-in-rdma-namespa.patch net-mlx5-refactor-mlx5_get_flow_namespace.patch net-mlx5-fix-rdma-tx-steering-prio.patch drm-v3d-ensure-job-pointer-is-set-to-null-after-job-.patch +hwmon-tmp513-fix-division-of-negative-numbers.patch +revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch +i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch +i2c-rcar-fix-nack-handling-when-being-a-target.patch