[PATCH 0/3] hwmon: (tmp513) Fix interpretation of values of TMP513 registers

[PATCH 0/3] hwmon: (tmp513) Fix interpretation of values of TMP513 registers

[Murad Masimov]

The function tmp51x_get_value returns processed values of the TMP513 device
registers. Raw register values are converted to signed integer values by sign
extension in accordance with the algorithm provided in the specification, but
due to the off-by-one error in the sign bit index, the result is incorrect.
There are also some other mistakes, such as incorrect cast.

Changes introduced by these patches are based on the TMP512/TMP513 datasheets
that are specified in Documentation/hwmon/tmp513.rst. They have not actually
been tested in any real or virtual environment. However the calculations have
been tested separately to make sure they work as expected.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Murad Masimov (3):
  hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and
    Limit Registers
  hwmon: (tmp513) Fix Current Register value interpretation
  hwmon: (tmp513) Fix interpretation of values of Temperature Result and
    Limit Registers

 drivers/hwmon/tmp513.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--
2.39.2

[PATCH 1/3] hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers

[Murad Masimov]

The values returned by the driver after processing the contents of the
Shunt Voltage Register and the Shunt Limit Registers do not correspond to the
TMP512/TMP513 specifications. A raw register value is converted to a signed
integer value by a sign extension in accordance with the algorithm provided in
the specification, but due to the off-by-one error in the sign bit index, the
result is incorrect. Moreover, the PGA shift calculated with the
tmp51x_get_pga_shift function is relevant only to the Shunt Voltage Register,
but is also applied to the Shunt Limit Registers.

According to the TMP512 and TMP513 datasheets, the Shunt Voltage Register (04h)
is 13 to 16 bit two's complement integer value, depending on the PGA setting.
The Shunt Positive (0Ch) and Negative (0Dh) Limit Registers are 16-bit two's
complement integer values. Below are some examples:

* Shunt Voltage Register
If PGA = 8, and regval = 1000 0011 0000 0000, then the decimal value must
be -32000, but the value calculated by the driver will be 33536.

* Shunt Limit Register
If regval = 1000 0011 0000 0000, then the decimal value must be -32000, but
the value calculated by the driver will be 768, if PGA = 1.

Fix sign bit index, and also correct misleading comment describing the
tmp51x_get_pga_shift function.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Murad Masimov <m.masimov@maxima.ru>
---
 drivers/hwmon/tmp513.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index 926d28cd3fab..d401cb55de14 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -182,7 +182,7 @@ struct tmp51x_data {
 	struct regmap *regmap;
 };

-// Set the shift based on the gain 8=4, 4=3, 2=2, 1=1
+// Set the shift based on the gain: 8 -> 1, 4 -> 2, 2 -> 3, 1 -> 4
 static inline u8 tmp51x_get_pga_shift(struct tmp51x_data *data)
 {
 	return 5 - ffs(data->pga_gain);
@@ -204,7 +204,9 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
 		 * 2's complement number shifted by one to four depending
 		 * on the pga gain setting. 1lsb = 10uV
 		 */
-		*val = sign_extend32(regval, 17 - tmp51x_get_pga_shift(data));
+		*val = sign_extend32(regval,
+			reg == TMP51X_SHUNT_CURRENT_RESULT ?
+			16 - tmp51x_get_pga_shift(data) : 15);
 		*val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms);
 		break;
 	case TMP51X_BUS_VOLTAGE_RESULT:
--
2.39.2

Re: [PATCH 1/3] hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers

[Guenter Roeck]

On Mon, Dec 16, 2024 at 08:36:46PM +0300, Murad Masimov wrote:
> The values returned by the driver after processing the contents of the
> Shunt Voltage Register and the Shunt Limit Registers do not correspond to the
> TMP512/TMP513 specifications. A raw register value is converted to a signed
> integer value by a sign extension in accordance with the algorithm provided in
> the specification, but due to the off-by-one error in the sign bit index, the
> result is incorrect. Moreover, the PGA shift calculated with the
> tmp51x_get_pga_shift function is relevant only to the Shunt Voltage Register,
> but is also applied to the Shunt Limit Registers.
> 
> According to the TMP512 and TMP513 datasheets, the Shunt Voltage Register (04h)
> is 13 to 16 bit two's complement integer value, depending on the PGA setting.
> The Shunt Positive (0Ch) and Negative (0Dh) Limit Registers are 16-bit two's
> complement integer values. Below are some examples:
> 
> * Shunt Voltage Register
> If PGA = 8, and regval = 1000 0011 0000 0000, then the decimal value must
> be -32000, but the value calculated by the driver will be 33536.
> 
> * Shunt Limit Register
> If regval = 1000 0011 0000 0000, then the decimal value must be -32000, but
> the value calculated by the driver will be 768, if PGA = 1.
> 
> Fix sign bit index, and also correct misleading comment describing the
> tmp51x_get_pga_shift function.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
> Signed-off-by: Murad Masimov <m.masimov@maxima.ru>

Applied, after fixing checkpatch complaints.

Guenter

[PATCH 2/3] hwmon: (tmp513) Fix Current Register value interpretation

[Murad Masimov]

The value returned by the driver after processing the contents of the Current
Register does not correspond to the TMP512/TMP513 specifications. A raw
register value is converted to a signed integer value by a sign extension in
accordance with the algorithm provided in the specification, but due to the
off-by-one error in the sign bit index, the result is incorrect. Moreover,
negative values will be reported as large positive due to missing sign
extension from u32 to long.

According to the TMP512 and TMP513 datasheets, the Current Register (07h) is a
16-bit two's complement integer value. E.g., if regval = 1000 0011 0000 0000,
then the value must be (-32000 * lsb), but the driver will return (33536 * lsb).

Fix off-by-one bug, and also cast data->curr_lsb_ua (which is of type u32) to
long to prevent incorrect cast for negative values.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Murad Masimov <m.masimov@maxima.ru>
---
 drivers/hwmon/tmp513.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index d401cb55de14..dacce7417bfd 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -222,7 +222,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
 		break;
 	case TMP51X_BUS_CURRENT_RESULT:
 		// Current = (ShuntVoltage * CalibrationRegister) / 4096
-		*val = sign_extend32(regval, 16) * data->curr_lsb_ua;
+		*val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua;
 		*val = DIV_ROUND_CLOSEST(*val, MILLI);
 		break;
 	case TMP51X_LOCAL_TEMP_RESULT:
--
2.39.2

Re: [PATCH 2/3] hwmon: (tmp513) Fix Current Register value interpretation

[Guenter Roeck]

On Mon, Dec 16, 2024 at 08:36:47PM +0300, Murad Masimov wrote:
> The value returned by the driver after processing the contents of the Current
> Register does not correspond to the TMP512/TMP513 specifications. A raw
> register value is converted to a signed integer value by a sign extension in
> accordance with the algorithm provided in the specification, but due to the
> off-by-one error in the sign bit index, the result is incorrect. Moreover,
> negative values will be reported as large positive due to missing sign
> extension from u32 to long.
> 
> According to the TMP512 and TMP513 datasheets, the Current Register (07h) is a
> 16-bit two's complement integer value. E.g., if regval = 1000 0011 0000 0000,
> then the value must be (-32000 * lsb), but the driver will return (33536 * lsb).
> 
> Fix off-by-one bug, and also cast data->curr_lsb_ua (which is of type u32) to
> long to prevent incorrect cast for negative values.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
> Signed-off-by: Murad Masimov <m.masimov@maxima.ru>

Applied, after fixing checkpatch complaints.

Guenter

[PATCH 3/3] hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers

[Murad Masimov]

The values returned by the driver after processing the contents of the
Temperature Result and the Temperature Limit Registers do not correspond to the
TMP512/TMP513 specifications. A raw register value is converted to a signed
integer value by a sign extension in accordance with the algorithm provided
in the specification, but due to the off-by-one error in the sign bit index,
the result is incorrect.

According to the TMP512 and TMP513 datasheets, the Temperature Result (08h to 0Bh)
and Limit (11h to 14h) Registers are 13-bit two's complement integer values,
shifted left by 3 bits. The value is scaled by 0.0625 degrees Celsius per bit.
E.g., if regval = 1 1110 0111 0000 000, the output should be -25 degrees,
but the driver will return +487 degrees.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Murad Masimov <m.masimov@maxima.ru>
---
 drivers/hwmon/tmp513.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index dacce7417bfd..be63a049923a 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -234,7 +234,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
 	case TMP51X_REMOTE_TEMP_LIMIT_2:
 	case TMP513_REMOTE_TEMP_LIMIT_3:
 		// 1lsb = 0.0625 degrees centigrade
-		*val = sign_extend32(regval, 16) >> TMP51X_TEMP_SHIFT;
+		*val = sign_extend32(regval, 15) >> TMP51X_TEMP_SHIFT;
 		*val = DIV_ROUND_CLOSEST(*val * 625, 10);
 		break;
 	case TMP51X_N_FACTOR_AND_HYST_1:
--
2.39.2