The MPU-3050 gyroscope output registers hold 16-bit two's complement
values; the angular velocity channels are declared with .sign = 's'.
When mpu3050_read_raw() handles IIO_CHAN_INFO_RAW it reads the register
via a big-endian regmap_bulk_read() and assigns it with:

	*val = be16_to_cpu(raw_val);

be16_to_cpu() yields an unsigned 16-bit quantity, so negative rates
(bit 15 set) are reported to userspace as large positive integers
(e.g. -1 becomes 65535) instead of the correct negative value.

Cast to s16 before the assignment, matching the temperature channel a
few lines above which already handles the sign correctly.

Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
 drivers/iio/gyro/mpu3050-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
index d84e04e4b431..07c0f9011c63 100644
--- a/drivers/iio/gyro/mpu3050-core.c
+++ b/drivers/iio/gyro/mpu3050-core.c
@@ -356,7 +356,7 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev,
 				goto out_read_raw_unlock;
 			}
 
-			*val = be16_to_cpu(raw_val);
+			*val = (s16)be16_to_cpu(raw_val);
 			ret = IIO_VAL_INT;
 
 			goto out_read_raw_unlock;
-- 
2.25.1

On Sun, Aug 2, 2026 at 8:55 AM Cong Nguyen <congnt264@gmail.com> wrote:

> The MPU-3050 gyroscope output registers hold 16-bit two's complement
> values; the angular velocity channels are declared with .sign = 's'.
> When mpu3050_read_raw() handles IIO_CHAN_INFO_RAW it reads the register
> via a big-endian regmap_bulk_read() and assigns it with:
>
>         *val = be16_to_cpu(raw_val);
>
> be16_to_cpu() yields an unsigned 16-bit quantity, so negative rates
> (bit 15 set) are reported to userspace as large positive integers
> (e.g. -1 becomes 65535) instead of the correct negative value.
>
> Cast to s16 before the assignment, matching the temperature channel a
> few lines above which already handles the sign correctly.
>
> Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4
> Signed-off-by: Cong Nguyen <congnt264@gmail.com>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

On Sun, 2 Aug 2026 23:30:31 +0200
Linus Walleij <linusw@kernel.org> wrote:

> On Sun, Aug 2, 2026 at 8:55 AM Cong Nguyen <congnt264@gmail.com> wrote:
> 
> > The MPU-3050 gyroscope output registers hold 16-bit two's complement
> > values; the angular velocity channels are declared with .sign = 's'.
> > When mpu3050_read_raw() handles IIO_CHAN_INFO_RAW it reads the register
> > via a big-endian regmap_bulk_read() and assigns it with:
> >
> >         *val = be16_to_cpu(raw_val);
> >
> > be16_to_cpu() yields an unsigned 16-bit quantity, so negative rates
> > (bit 15 set) are reported to userspace as large positive integers
> > (e.g. -1 becomes 65535) instead of the correct negative value.
> >
> > Cast to s16 before the assignment, matching the temperature channel a
> > few lines above which already handles the sign correctly.
> >
> > Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> > Cc: stable@vger.kernel.org
> > Assisted-by: Claude:claude-opus-4
> > Signed-off-by: Cong Nguyen <congnt264@gmail.com>  
> 
> Reviewed-by: Linus Walleij <linusw@kernel.org>
Applied to the fixes-togreg branch of iio.git

Note this will probably not go upstream until the merge window.

Thanks,

Jonathan

> 
> Yours,
> Linus Walleij

On Sun,  2 Aug 2026 13:55:40 +0700
Cong Nguyen <congnt264@gmail.com> wrote:

> The MPU-3050 gyroscope output registers hold 16-bit two's complement
> values; the angular velocity channels are declared with .sign = 's'.
> When mpu3050_read_raw() handles IIO_CHAN_INFO_RAW it reads the register
> via a big-endian regmap_bulk_read() and assigns it with:
> 
> 	*val = be16_to_cpu(raw_val);
> 
> be16_to_cpu() yields an unsigned 16-bit quantity, so negative rates
> (bit 15 set) are reported to userspace as large positive integers
> (e.g. -1 becomes 65535) instead of the correct negative value.
> 
> Cast to s16 before the assignment, matching the temperature channel a
> few lines above which already handles the sign correctly.
> 

LGTM.

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts

On 8/2/26 1:55 AM, Cong Nguyen wrote:
> The MPU-3050 gyroscope output registers hold 16-bit two's complement
> values; the angular velocity channels are declared with .sign = 's'.
> When mpu3050_read_raw() handles IIO_CHAN_INFO_RAW it reads the register
> via a big-endian regmap_bulk_read() and assigns it with:
> 
> 	*val = be16_to_cpu(raw_val);
> 
> be16_to_cpu() yields an unsigned 16-bit quantity, so negative rates
> (bit 15 set) are reported to userspace as large positive integers
> (e.g. -1 becomes 65535) instead of the correct negative value.
> 
> Cast to s16 before the assignment, matching the temperature channel a
> few lines above which already handles the sign correctly.
> 
> Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4
> Signed-off-by: Cong Nguyen <congnt264@gmail.com>
> ---
>  drivers/iio/gyro/mpu3050-core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
> index d84e04e4b431..07c0f9011c63 100644
> --- a/drivers/iio/gyro/mpu3050-core.c
> +++ b/drivers/iio/gyro/mpu3050-core.c
> @@ -356,7 +356,7 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev,
>  				goto out_read_raw_unlock;
>  			}
>  
> -			*val = be16_to_cpu(raw_val);
> +			*val = (s16)be16_to_cpu(raw_val);
>  			ret = IIO_VAL_INT;
>  
>  			goto out_read_raw_unlock;

Usually, we use sign_extend32() instead of a cast for this. But this
driver already has a similar cast for the temperature channel. So to
keep it consistent, this looks fine.

Reviewed-by: David Lechner <dlechner@baylibre.com>