From: Sasha Levin Date: Mon, 27 Dec 2021 03:37:33 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v4.4.297~43 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=67cdddbec8c8068dde870bf0ec7b9b0a18001e07;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/hwmon-lm90-add-basic-support-for-ti-tmp461.patch b/queue-5.10/hwmon-lm90-add-basic-support-for-ti-tmp461.patch new file mode 100644 index 00000000000..35e1318f91b --- /dev/null +++ b/queue-5.10/hwmon-lm90-add-basic-support-for-ti-tmp461.patch @@ -0,0 +1,187 @@ +From 340ce0419146c1dee71ca1632b9e69cad42f8027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 20:03:32 -0700 +Subject: hwmon: (lm90) Add basic support for TI TMP461 + +From: Guenter Roeck + +[ Upstream commit f8344f7693a25d9025a59d164450b50c6f5aa3c0 ] + +TMP461 is almost identical to TMP451 and was actually detected as TMP451 +with the existing lm90 driver if its I2C address is 0x4c. Add support +for it to the lm90 driver. At the same time, improve the chip detection +function to at least try to distinguish between TMP451 and TMP461. + +As a side effect, this fixes commit 24333ac26d01 ("hwmon: (tmp401) use +smb word operations instead of 2 smb byte operations"). TMP461 does not +support word operations on temperature registers, which causes bad +temperature readings with the tmp401 driver. The lm90 driver does not +perform word operations on temperature registers and thus does not have +this problem. + +Support is listed as basic because TMP461 supports a sensor resolution +of 0.0625 degrees C, while the lm90 driver assumes a resolution of 0.125 +degrees C. Also, the TMP461 supports negative temperatures with its +default temperature range, which is not the case for similar chips +supported by the lm90 and the tmp401 drivers. Those limitations will be +addressed with follow-up patches. + +Fixes: 24333ac26d01 ("hwmon: (tmp401) use smb word operations instead of 2 smb byte operations") +Reported-by: David T. Wilson +Cc: David T. Wilson +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/lm90.rst | 10 +++++++ + drivers/hwmon/Kconfig | 2 +- + drivers/hwmon/lm90.c | 54 ++++++++++++++++++++++++++---------- + 3 files changed, 50 insertions(+), 16 deletions(-) + +diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst +index 3da8c6e06a365..05391fb4042d9 100644 +--- a/Documentation/hwmon/lm90.rst ++++ b/Documentation/hwmon/lm90.rst +@@ -265,6 +265,16 @@ Supported chips: + + https://www.ti.com/litv/pdf/sbos686 + ++ * Texas Instruments TMP461 ++ ++ Prefix: 'tmp461' ++ ++ Addresses scanned: I2C 0x48 through 0x4F ++ ++ Datasheet: Publicly available at TI website ++ ++ https://www.ti.com/lit/gpn/tmp461 ++ + Author: Jean Delvare + + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index a850e4f0e0bde..0c2b032ee6176 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1275,7 +1275,7 @@ config SENSORS_LM90 + Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658, + MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, + ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG, +- Philips SA56004, GMT G781, and Texas Instruments TMP451 ++ Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461 + sensor chips. + + This driver can also be built as a module. If so, the module +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index ef55a1486099f..ffda70dcd9ae9 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -69,10 +69,10 @@ + * This driver also supports the G781 from GMT. This device is compatible + * with the ADM1032. + * +- * This driver also supports TMP451 from Texas Instruments. This device is +- * supported in both compatibility and extended mode. It's mostly compatible +- * with ADT7461 except for local temperature low byte register and max +- * conversion rate. ++ * This driver also supports TMP451 and TMP461 from Texas Instruments. ++ * Those devices are supported in both compatibility and extended mode. ++ * They are mostly compatible with ADT7461 except for local temperature ++ * low byte register and max conversion rate. + * + * Since the LM90 was the first chipset supported by this driver, most + * comments will refer to this chipset, but are actually general and +@@ -112,7 +112,7 @@ static const unsigned short normal_i2c[] = { + 0x4d, 0x4e, 0x4f, I2C_CLIENT_END }; + + enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, +- max6646, w83l771, max6696, sa56004, g781, tmp451, max6654 }; ++ max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 }; + + /* + * The LM90 registers +@@ -168,8 +168,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + + #define LM90_MAX_CONVRATE_MS 16000 /* Maximum conversion rate in ms */ + +-/* TMP451 registers */ ++/* TMP451/TMP461 registers */ + #define TMP451_REG_R_LOCAL_TEMPL 0x15 ++#define TMP451_REG_CONALERT 0x22 ++ ++#define TMP461_REG_CHEN 0x16 ++#define TMP461_REG_DFC 0x24 + + /* + * Device flags +@@ -229,6 +233,7 @@ static const struct i2c_device_id lm90_id[] = { + { "w83l771", w83l771 }, + { "sa56004", sa56004 }, + { "tmp451", tmp451 }, ++ { "tmp461", tmp461 }, + { } + }; + MODULE_DEVICE_TABLE(i2c, lm90_id); +@@ -326,6 +331,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { + .compatible = "ti,tmp451", + .data = (void *)tmp451 + }, ++ { ++ .compatible = "ti,tmp461", ++ .data = (void *)tmp461 ++ }, + { }, + }; + MODULE_DEVICE_TABLE(of, lm90_of_match); +@@ -427,6 +436,13 @@ static const struct lm90_params lm90_params[] = { + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, + }, ++ [tmp461] = { ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ .alert_alarms = 0x7c, ++ .max_convrate = 9, ++ .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, ++ }, + }; + + /* +@@ -1616,18 +1632,26 @@ static int lm90_detect(struct i2c_client *client, + && convrate <= 0x08) + name = "g781"; + } else +- if (address == 0x4C +- && man_id == 0x55) { /* Texas Instruments */ +- int local_ext; ++ if (man_id == 0x55 && chip_id == 0x00 && ++ (config1 & 0x1B) == 0x00 && convrate <= 0x09) { ++ int local_ext, conalert, chen, dfc; + + local_ext = i2c_smbus_read_byte_data(client, + TMP451_REG_R_LOCAL_TEMPL); +- +- if (chip_id == 0x00 /* TMP451 */ +- && (config1 & 0x1B) == 0x00 +- && convrate <= 0x09 +- && (local_ext & 0x0F) == 0x00) +- name = "tmp451"; ++ conalert = i2c_smbus_read_byte_data(client, ++ TMP451_REG_CONALERT); ++ chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN); ++ dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC); ++ ++ if ((local_ext & 0x0F) == 0x00 && ++ (conalert & 0xf1) == 0x01 && ++ (chen & 0xfc) == 0x00 && ++ (dfc & 0xfc) == 0x00) { ++ if (address == 0x4c && !(chen & 0x03)) ++ name = "tmp451"; ++ else if (address >= 0x48 && address <= 0x4f) ++ name = "tmp461"; ++ } + } + + if (!name) { /* identification failed */ +-- +2.34.1 + diff --git a/queue-5.10/hwmon-lm90-drop-critical-attribute-support-for-max66.patch b/queue-5.10/hwmon-lm90-drop-critical-attribute-support-for-max66.patch new file mode 100644 index 00000000000..b424126dd99 --- /dev/null +++ b/queue-5.10/hwmon-lm90-drop-critical-attribute-support-for-max66.patch @@ -0,0 +1,224 @@ +From 66ddee81e16963ef57a24c6ac9e0a276ea2a74aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Nov 2021 08:55:06 -0800 +Subject: hwmon: (lm90) Drop critical attribute support for MAX6654 + +From: Guenter Roeck + +[ Upstream commit 16ba51b5dcd3f6dde2e51d5ccc86313119dcf889 ] + +Tests with a real chip and a closer look into the datasheet show that +MAX6654 does not support CRIT/THERM/OVERTEMP limits, so drop support +of the respective attributes for this chip. + +Introduce LM90_HAVE_CRIT flag and use it to instantiate critical limit +attributes to solve the problem. + +Cc: Josh Lehan +Fixes: 229d495d8189 ("hwmon: (lm90) Add max6654 support to lm90 driver") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 86 +++++++++++++++++++++++++------------------- + 1 file changed, 49 insertions(+), 37 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 2961e992faa85..97e0332f46790 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -35,13 +35,14 @@ + * explicitly as max6659, or if its address is not 0x4c. + * These chips lack the remote temperature offset feature. + * +- * This driver also supports the MAX6654 chip made by Maxim. This chip can +- * be at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is +- * otherwise similar to MAX6657/MAX6658/MAX6659. Extended range is available +- * by setting the configuration register accordingly, and is done during +- * initialization. Extended precision is only available at conversion rates +- * of 1 Hz and slower. Note that extended precision is not enabled by +- * default, as this driver initializes all chips to 2 Hz by design. ++ * This driver also supports the MAX6654 chip made by Maxim. This chip can be ++ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar ++ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature ++ * limits. Extended range is available by setting the configuration register ++ * accordingly, and is done during initialization. Extended precision is only ++ * available at conversion rates of 1 Hz and slower. Note that extended ++ * precision is not enabled by default, as this driver initializes all chips ++ * to 2 Hz by design. + * + * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and + * MAX6692 chips made by Maxim. These are again similar to the LM86, +@@ -188,6 +189,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */ + #define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/ + #define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */ ++#define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */ + + /* LM90 status */ + #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ +@@ -354,38 +356,43 @@ struct lm90_params { + static const struct lm90_params lm90_params[] = { + [adm1032] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, + [adt7461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, + [g781] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + }, + [lm86] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [lm90] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [lm99] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [max6646] = { ++ .flags = LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, +@@ -396,50 +403,50 @@ static const struct lm90_params lm90_params[] = { + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6657] = { +- .flags = LM90_PAUSE_FOR_CONFIG, ++ .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6659] = { +- .flags = LM90_HAVE_EMERGENCY, ++ .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6680] = { +- .flags = LM90_HAVE_OFFSET, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 7, + }, + [max6696] = { + .flags = LM90_HAVE_EMERGENCY +- | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3, ++ | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT, + .alert_alarms = 0x1c7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [w83l771] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + }, + [sa56004] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL, + }, + [tmp451] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, + }, + [tmp461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, +@@ -667,20 +674,22 @@ static int lm90_update_limits(struct device *dev) + struct i2c_client *client = data->client; + int val; + +- val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); +- if (val < 0) +- return val; +- data->temp8[LOCAL_CRIT] = val; ++ if (data->flags & LM90_HAVE_CRIT) { ++ val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); ++ if (val < 0) ++ return val; ++ data->temp8[LOCAL_CRIT] = val; + +- val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); +- if (val < 0) +- return val; +- data->temp8[REMOTE_CRIT] = val; ++ val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); ++ if (val < 0) ++ return val; ++ data->temp8[REMOTE_CRIT] = val; + +- val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); +- if (val < 0) +- return val; +- data->temp_hyst = val; ++ val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); ++ if (val < 0) ++ return val; ++ data->temp_hyst = val; ++ } + + val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH); + if (val < 0) +@@ -1866,11 +1875,14 @@ static int lm90_probe(struct i2c_client *client) + info->config = data->channel_config; + + data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | +- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | +- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM; ++ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM; + data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | +- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | +- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT; ++ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT; ++ ++ if (data->flags & LM90_HAVE_CRIT) { ++ data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; ++ data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; ++ } + + if (data->flags & LM90_HAVE_OFFSET) + data->channel_config[1] |= HWMON_T_OFFSET; +-- +2.34.1 + diff --git a/queue-5.10/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch b/queue-5.10/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch new file mode 100644 index 00000000000..c179cf0a854 --- /dev/null +++ b/queue-5.10/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch @@ -0,0 +1,50 @@ +From 1c1cf784cd9fe01f2448f4fddb94ada3a478657f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 10:02:44 -0700 +Subject: hwmon: (lm90) Fix usage of CONFIG2 register in detect function + +From: Guenter Roeck + +[ Upstream commit fce15c45d3fbd9fc1feaaf3210d8e3f8b33dfd3a ] + +The detect function had a comment "Make compiler happy" when id did not +read the second configuration register. As it turns out, the code was +checking the contents of this register for manufacturer ID 0xA1 (NXP +Semiconductor/Philips), but never actually read the register. So it +wasn't surprising that the compiler complained, and it indeed had a point. +Fix the code to read the register contents for manufacturer ID 0xa1. + +At the same time, the code was reading the register for manufacturer ID +0x41 (Analog Devices), but it was not using the results. In effect it was +just checking if reading the register returned an error. That doesn't +really add much if any value, so stop doing that. + +Fixes: f90be42fb383 ("hwmon: (lm90) Refactor reading of config2 register") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index ebbfd5f352c06..ef55a1486099f 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -1438,12 +1438,11 @@ static int lm90_detect(struct i2c_client *client, + if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0) + return -ENODEV; + +- if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) { ++ if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) { + config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2); + if (config2 < 0) + return -ENODEV; +- } else +- config2 = 0; /* Make compiler happy */ ++ } + + if ((address == 0x4C || address == 0x4D) + && man_id == 0x01) { /* National Semiconductor */ +-- +2.34.1 + diff --git a/queue-5.10/hwmon-lm90-introduce-flag-indicating-extended-temper.patch b/queue-5.10/hwmon-lm90-introduce-flag-indicating-extended-temper.patch new file mode 100644 index 00000000000..d9881e28f12 --- /dev/null +++ b/queue-5.10/hwmon-lm90-introduce-flag-indicating-extended-temper.patch @@ -0,0 +1,117 @@ +From 7634477d628f87bb09b1e9729e0a227bc5852e2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 01:49:50 -0700 +Subject: hwmon: (lm90) Introduce flag indicating extended temperature support + +From: Guenter Roeck + +[ Upstream commit f347e249fcf920ad6974cbd898e2ec0b366a1c34 ] + +A flag indicating extended temperature support makes it easier +to add support for additional chips with this functionality. + +Cc: David T. Wilson +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index ffda70dcd9ae9..2961e992faa85 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -186,7 +186,8 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */ + #define LM90_HAVE_TEMP3 (1 << 6) /* 3rd temperature sensor */ + #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */ +-#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */ ++#define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/ ++#define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */ + + /* LM90 status */ + #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ +@@ -359,7 +360,7 @@ static const struct lm90_params lm90_params[] = { + }, + [adt7461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, +@@ -431,7 +432,7 @@ static const struct lm90_params lm90_params[] = { + }, + [tmp451] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, +@@ -1013,7 +1014,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index) + s16 temp11 = data->temp11[index]; + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u16_adt7461(data, temp11); + else if (data->kind == max6646) + temp = temp_from_u16(temp11); +@@ -1047,7 +1048,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val) + if (data->kind == lm99 && index <= 2) + val -= 16000; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + data->temp11[index] = temp_to_u16_adt7461(data, val); + else if (data->kind == max6646) + data->temp11[index] = temp_to_u8(val) << 8; +@@ -1074,7 +1075,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index) + s8 temp8 = data->temp8[index]; + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, temp8); + else if (data->kind == max6646) + temp = temp_from_u8(temp8); +@@ -1107,7 +1108,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val) + if (data->kind == lm99 && index == 3) + val -= 16000; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + data->temp8[index] = temp_to_u8_adt7461(data, val); + else if (data->kind == max6646) + data->temp8[index] = temp_to_u8(val); +@@ -1125,7 +1126,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index) + { + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, data->temp8[index]); + else if (data->kind == max6646) + temp = temp_from_u8(data->temp8[index]); +@@ -1145,7 +1146,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val) + int temp; + int err; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]); + else if (data->kind == max6646) + temp = temp_from_u8(data->temp8[LOCAL_CRIT]); +@@ -1698,7 +1699,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) + lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */ + + /* Check Temperature Range Select */ +- if (data->kind == adt7461 || data->kind == tmp451) { ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) { + if (config & 0x04) + data->flags |= LM90_FLAG_ADT7461_EXT; + } +-- +2.34.1 + diff --git a/queue-5.10/input-elantech-fix-stack-out-of-bound-access-in-elan.patch b/queue-5.10/input-elantech-fix-stack-out-of-bound-access-in-elan.patch new file mode 100644 index 00000000000..b92cfe59d84 --- /dev/null +++ b/queue-5.10/input-elantech-fix-stack-out-of-bound-access-in-elan.patch @@ -0,0 +1,139 @@ +From 8427965f891227c81df100a782ce802ead631b1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 00:08:13 -0800 +Subject: Input: elantech - fix stack out of bound access in + elantech_change_report_id() + +From: Andrea Righi + +[ Upstream commit 1d72d9f960ccf1052a0630a68c3d358791dbdaaa ] + +The array param[] in elantech_change_report_id() must be at least 3 +bytes, because elantech_read_reg_params() is calling ps2_command() with +PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but +it's defined in the stack as an array of 2 bytes, therefore we have a +potential stack out-of-bounds access here, also confirmed by KASAN: + +[ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0 +[ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118 + +[ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 +[ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 +[ 6.512436] Workqueue: events_long serio_handle_event +[ 6.512453] Call Trace: +[ 6.512462] show_stack+0x52/0x58 +[ 6.512474] dump_stack+0xa1/0xd3 +[ 6.512487] print_address_description.constprop.0+0x1d/0x140 +[ 6.512502] ? __ps2_command+0x372/0x7e0 +[ 6.512516] __kasan_report.cold+0x7d/0x112 +[ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 +[ 6.512539] ? __ps2_command+0x372/0x7e0 +[ 6.512552] kasan_report+0x3c/0x50 +[ 6.512564] __asan_load1+0x6a/0x70 +[ 6.512575] __ps2_command+0x372/0x7e0 +[ 6.512589] ? ps2_drain+0x240/0x240 +[ 6.512601] ? dev_printk_emit+0xa2/0xd3 +[ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 +[ 6.512621] ? __kasan_check_write+0x14/0x20 +[ 6.512634] ? mutex_lock+0x8f/0xe0 +[ 6.512643] ? __mutex_lock_slowpath+0x20/0x20 +[ 6.512655] ps2_command+0x52/0x90 +[ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] +[ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] +[ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] +[ 6.512863] ? ps2_command+0x7f/0x90 +[ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] +[ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] +[ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] +[ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] +[ 6.513122] ? phys_pmd_init+0x30e/0x521 +[ 6.513137] elantech_init+0x8a/0x200 [psmouse] +[ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] +[ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] +[ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] +[ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] +[ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] +[ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] +[ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] +[ 6.513519] ? mutex_unlock+0x22/0x40 +[ 6.513526] ? ps2_command+0x7f/0x90 +[ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] +[ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] +[ 6.513624] psmouse_connect+0x272/0x530 [psmouse] +[ 6.513669] serio_driver_probe+0x55/0x70 +[ 6.513679] really_probe+0x190/0x720 +[ 6.513689] driver_probe_device+0x160/0x1f0 +[ 6.513697] device_driver_attach+0x119/0x130 +[ 6.513705] ? device_driver_attach+0x130/0x130 +[ 6.513713] __driver_attach+0xe7/0x1a0 +[ 6.513720] ? device_driver_attach+0x130/0x130 +[ 6.513728] bus_for_each_dev+0xfb/0x150 +[ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 +[ 6.513748] ? _raw_write_unlock_bh+0x30/0x30 +[ 6.513757] driver_attach+0x2d/0x40 +[ 6.513764] serio_handle_event+0x199/0x3d0 +[ 6.513775] process_one_work+0x471/0x740 +[ 6.513785] worker_thread+0x2d2/0x790 +[ 6.513794] ? process_one_work+0x740/0x740 +[ 6.513802] kthread+0x1b4/0x1e0 +[ 6.513809] ? set_kthread_struct+0x80/0x80 +[ 6.513816] ret_from_fork+0x22/0x30 + +[ 6.513832] The buggy address belongs to the page: +[ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 +[ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) +[ 6.513860] raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 +[ 6.513867] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 +[ 6.513872] page dumped because: kasan: bad access detected + +[ 6.513879] addr ffff8881024d77c2 is located in stack of task kworker/2:1/118 at offset 34 in frame: +[ 6.513887] elantech_change_report_id+0x0/0x256 [psmouse] + +[ 6.513941] this frame has 1 object: +[ 6.513947] [32, 34) 'param' + +[ 6.513956] Memory state around the buggy address: +[ 6.513962] ffff8881024d7680: f2 f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 +[ 6.513969] ffff8881024d7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 6.513976] >ffff8881024d7780: 00 00 00 00 f1 f1 f1 f1 02 f3 f3 f3 00 00 00 00 +[ 6.513982] ^ +[ 6.513988] ffff8881024d7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 6.513995] ffff8881024d7880: 00 f1 f1 f1 f1 03 f2 03 f2 03 f3 f3 f3 00 00 00 +[ 6.514000] ================================================================== + +Define param[] in elantech_change_report_id() as an array of 3 bytes to +prevent the out-of-bounds access in the stack. + +Fixes: e4c9062717fe ("Input: elantech - fix protocol errors for some trackpoints in SMBus mode") +BugLink: https://bugs.launchpad.net/bugs/1945590 +Signed-off-by: Andrea Righi +Reviewed-by: Wolfram Sang +Link: https://lore.kernel.org/r/20211116095559.24395-1-andrea.righi@canonical.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elantech.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 4357d30c15c56..2e53ea261e014 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = { + */ + static int elantech_change_report_id(struct psmouse *psmouse) + { +- unsigned char param[2] = { 0x10, 0x03 }; ++ /* ++ * NOTE: the code is expecting to receive param[] as an array of 3 ++ * items (see __ps2_command()), even if in this case only 2 are ++ * actually needed. Make sure the array size is 3 to avoid potential ++ * stack out-of-bound accesses. ++ */ ++ unsigned char param[3] = { 0x10, 0x03 }; + + if (elantech_write_reg_params(psmouse, 0x7, param) || + elantech_read_reg_params(psmouse, 0x7, param) || +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch b/queue-5.10/pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch new file mode 100644 index 00000000000..79e15df248a --- /dev/null +++ b/queue-5.10/pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch @@ -0,0 +1,95 @@ +From 52998e9809153f58d5d0e831000fe7a2c576bf67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Dec 2021 09:22:36 +0000 +Subject: pinctrl: bcm2835: Change init order for gpio hogs + +From: Phil Elwell + +[ Upstream commit 266423e60ea1b953fcc0cd97f3dad85857e434d1 ] + +...and gpio-ranges + +pinctrl-bcm2835 is a combined pinctrl/gpio driver. Currently the gpio +side is registered first, but this breaks gpio hogs (which are +configured during gpiochip_add_data). Part of the hog initialisation +is a call to pinctrl_gpio_request, and since the pinctrl driver hasn't +yet been registered this results in an -EPROBE_DEFER from which it can +never recover. + +Change the initialisation sequence to register the pinctrl driver +first. + +This also solves a similar problem with the gpio-ranges property, which +is required in order for released pins to be returned to inputs. + +Fixes: 73345a18d464b ("pinctrl: bcm2835: Pass irqchip when adding gpiochip") +Signed-off-by: Phil Elwell +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20211206092237.4105895-2-phil@raspberrypi.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 29 +++++++++++++++------------ + 1 file changed, 16 insertions(+), 13 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index 1d21129f7751c..40ce18a0d0190 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -1244,6 +1244,18 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) + raw_spin_lock_init(&pc->irq_lock[i]); + } + ++ pc->pctl_desc = *pdata->pctl_desc; ++ pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc); ++ if (IS_ERR(pc->pctl_dev)) { ++ gpiochip_remove(&pc->gpio_chip); ++ return PTR_ERR(pc->pctl_dev); ++ } ++ ++ pc->gpio_range = *pdata->gpio_range; ++ pc->gpio_range.base = pc->gpio_chip.base; ++ pc->gpio_range.gc = &pc->gpio_chip; ++ pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range); ++ + girq = &pc->gpio_chip.irq; + girq->chip = &bcm2835_gpio_irq_chip; + girq->parent_handler = bcm2835_gpio_irq_handler; +@@ -1251,8 +1263,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) + girq->parents = devm_kcalloc(dev, BCM2835_NUM_IRQS, + sizeof(*girq->parents), + GFP_KERNEL); +- if (!girq->parents) ++ if (!girq->parents) { ++ pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); + return -ENOMEM; ++ } + + if (is_7211) { + pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS, +@@ -1303,21 +1317,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) + err = gpiochip_add_data(&pc->gpio_chip, pc); + if (err) { + dev_err(dev, "could not add GPIO chip\n"); ++ pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); + return err; + } + +- pc->pctl_desc = *pdata->pctl_desc; +- pc->pctl_dev = devm_pinctrl_register(dev, &pc->pctl_desc, pc); +- if (IS_ERR(pc->pctl_dev)) { +- gpiochip_remove(&pc->gpio_chip); +- return PTR_ERR(pc->pctl_dev); +- } +- +- pc->gpio_range = *pdata->gpio_range; +- pc->gpio_range.base = pc->gpio_chip.base; +- pc->gpio_range.gc = &pc->gpio_chip; +- pinctrl_add_gpio_range(pc->pctl_dev, &pc->gpio_range); +- + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 82acf6b31bc..3402cb0ed71 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -25,3 +25,9 @@ drivers-net-smc911x-check-for-error-irq.patch net-ks8851-check-for-error-irq.patch sfc-check-null-pointer-of-rx_queue-page_ring.patch sfc-falcon-check-null-pointer-of-rx_queue-page_ring.patch +input-elantech-fix-stack-out-of-bound-access-in-elan.patch +pinctrl-bcm2835-change-init-order-for-gpio-hogs.patch +hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch +hwmon-lm90-add-basic-support-for-ti-tmp461.patch +hwmon-lm90-introduce-flag-indicating-extended-temper.patch +hwmon-lm90-drop-critical-attribute-support-for-max66.patch