The call to cdns3_gadget_ep_free_request will free priv_req so do the
call to list_del_init which accesses the memory pointed to by priv_req
before the free.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
The existing compatible name for U-Boot's k3 system controller driver
i.e "ti,am625-system-controller" has been added to linux[1] device-tree.
This compatible in kernel is meant for configuring the Control Module
registers (CTRL_MMR0).
However in U-Boot, the matching driver was being used to load the system
firmware on the secure M-cores by the R5 SPL and therefore must be
updated to a different compatible to avoid conflicts.
Therefore, this patch renames all references of the compatible to
"ti,am654-tisci-rproc-r5". The "-r5" is appended so as to avoid any
future conflicts since r5 specific compatibles should only be useful for
U-Boot.
[1]: 5959618631fe ("dt-bindings: mfd: ti,j721e-system-controller: Add compatible string for AM654")
https://lore.kernel.org/r/20250421214620.3770172-2-afd@ti.com
Signed-off-by: Anshul Dalal <anshuld@ti.com>
Avoid unlimited while loop by adding a timeout. The timeout is
calculated based on a minimal throughput of 256 KB/s.
The timeout is set at least to 2 seconds.
Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
File system such as YAFFS2 need to know the number of available
OOB bytes per page to be able to choose if they should locate their
metadata in the data area or in the spare area.
Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
In zynqmp_pinconf_set if param is PIN_CFG_IOSTANDARD or
PIN_CONFIG_POWER_SOURCE and zynqmp_pm_pinctrl_get_config returns an
error then value will not be assigned to when its value is tested to be
not equal to arg. Add code to only test value not equal to arg if ret is
false.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Link: https://lore.kernel.org/r/20250807-pinctrl_misc-v1-4-eeb564a1b032@linaro.org
Signed-off-by: Michal Simek <michal.simek@amd.com>
Use GUSBCFG_FORCEHOSTMODE to detected the HOST forced mode as it is done
in the Linux driver drivers/usb/dwc2/core.c:dwc2_core_reset().
The host polling must be executed only if the current mode is host,
either due to the force HOST mode (which persists after core reset)
or the connector id pin.
The GUSBCFG_FORCEDEVMODE bits is used to force the device mode (for
example used on STM32MP1x platform) and when it is activated the DWC2 reset
failed with the trace:
"dwc2_core_reset: Waiting for GINTSTS_CURMODE_HOST timeout"
Fixes: c5d685b899 ("usb: dwc2: Unify flush and reset logic with v4.20a support")
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Junhui Liu <junhui.liu@pigmoral.tech>
Tested-by: Patrice Chotard <patrice.chotard@foss.st.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
When the usb node is defined dr_mode="otg" ehci_usb_phy_mode() is called
to determine the mode from status registers.
The IMX95RM does not currently define the USBNC STATUS register but it is
assumed to be an omission as the first three registers are defined.
It has been expirimentally verified that the USBNC_PHY_STATUS register
at offset 0x23C bit4 (USBNC_PHYSTATUS_ID_DIG) reads 0 when USB_ID is GND
and 1 when floating.
Use is_imx9() as this driver works for i.MX91, i.MX93 and i.MX95 and all
of these determine the role based on the USBNC_PHY_STATUS register.
Fixes: 801b5fafd3 "(usb: ehci-mx6: Add i.MX95 support")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Alice Guo <alice.guo@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Add initial support for i.MX95 USB.30 PHY, which is similar to
the i.MX8MQ and i.MX8MP USB PHY.
The i.MX95 USB3 PHY has a Type-C Assist block (TCA) consisting of two
functional blocks (XBar assist and VBus assist) and is documented
in the i.MX95 RM Chapter 163.3.8 Type-C assist (TCA) block.
Instead of relying on an external MUX for Type-C plug orientation the
XBar can handle the flip internally.
Add initial support for i.MX95 by:
- allowing the driver to be enabled i.MX95
- resetting the XBar
- configuring the TCA in System Configuration mode (which was determined
to be necessary to enable the PHY in device-mode)
Follow-on support will need to be added to steer the XBar based on
either board design (if only one pair is brought out) or if used with a
Type-C controller.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Tested-by: Alice Guo <alice.guo@nxp.com>
In nanddev_init mtd and memorg are assigned values that dereference nand
but this happens before a NULL check for nand. Move the assignments
after the NULL check.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
The driver currently does:
mtd->dev->parent = cadence->dev;
This works in Linux because `struct mtd_info` embeds a `struct device`,
so `mtd->dev` is always valid and its `.parent` can be set.
In U-Boot, however, `mtd->dev` is only a pointer to a `struct udevice`.
Dereferencing it before assignment is invalid, which breaks the device
hierarchy. As a result, consumers relying on `mtd->dev` (e.g. partition
parser, reset and re-init paths) operate on a dangling pointer. This
leads to failures during warm reset when the NAND device is accessed
again.
Fix by assigning the device pointer directly:
mtd->dev = cadence->dev;
This matches U-Boot’s device model, preserves a valid hierarchy, and
resolves the warm reset issue on Cadence NAND.
Fixes: ebc41cad ("drivers: mtd: nand: Add driver for Cadence Nand")
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
dvw_min_byte1_table have 128 elements per channel. The variable
vref_stop_index is limited to be a maximum of 128. This means that the
index used to access the arrays must use a test of '< vref_stop_index'
rather than '<= vref_stop_index' in order to prevent out of bounds
accesses to the arrays.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Pull request net-20250818.
This is mostly code cleanup and fixes, mainly for issues reported by the
Smatch tool, plus two small features for NET_LWIP as well as support for
the BCM54612E phy.
net-common:
- Fix a bunch of issues reported by Smatch
- Introduce CONFIG_DNS
- Add support for BCM54612E phy
net-legacy:
- Add missing SPDX-License-Identifier for files originating from LiMon
net-lwip:
- ping: initialize net_try_count to 1
- sntp: remove redundant sys_check_timeouts()
- tftp: resend initial request
- Add Kconfig option to show ICMP unreachable errors
In cdns_torrent_phy_probe the test for too many lanes configured does
not set an error code before taking the error path. This could lead to a
silent failure if the calling code does not detect the error. Add the
code to return -EINVAL in this case.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In cdns_sierra_pll_bind_of_clocks the variable 'i' is declared but never
assigned to before its value is used in a dev_err. Replace clk_names[i]
by the name passed to device_bind(), i.e., "pll_mux_clk". With that, the
clk_names[] array is unused and can therefore be removed.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
[jf: update description]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
In ks8851_mll_detect_chip the if..else code detects the case of (val &
0xfff0) != CIDER_ID and returns if found. So testing for this again will
always fail and the code is unreachable. Just remove the test and code
block.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In ca_phy_probe when checking for an external phy it uses a field from
the internal phy due to what is assumed to be a copy/paste typo. Make
the obvious fix to use the field from the external phy.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In rvu_af_init if the code fails to allocate memory for nix_af it will
take the error path with nix_af == NULL which will dereference nix_af.
Add the appropriate NULL check.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In nix_lf_setup there is a default value assigned to err in case an
error is detected. However this default value will be overwritten in the
for loop so that later code does not return an error code from the
function. Add a new assignment to restore err to the default error code.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In mvpp2_probe the code attempts to get a value for "gop-port-id" and
assigns it to port->gop_id but it then tests port->id for being equal to
-1. That is an impossible test as port->id is a field of type u8 so
cannot be negative. Change the test to port->gop_id.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In phy_info_parse all uses of the variable phyaddr are as an int so
declaring as u32 is not useful and prevents the test for an error return
from fdtdec_get_int ever detecting an error. Change phyaddr to be an
int.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
You cannot test an unsigned char to be >= 256. Instead make the
variables start and end to be ints.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In mv88e6xxx_port_enable when attempting to mask out the previous
settings of two bits a logical operator was used instead of a bitwise
operator. Fix this.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In mtk_eth_of_to_plat, the last error check has the value in
'priv->phy_addr' but returns ret. Correct to return 'priv->phy_addr'
instead.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In ldpaa_eth_open a memset is used to initialise a struct to 0 but the
size passed is that of a different struct. Correct to pass the sizeof
the struct that is being initialised.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
get_timer returns a ulong value representing system time in ms.
On a 64-bit system, this ulong value is 64 bits long. However,
the driver stores it in a 32-bit unsigned integer, which overflows
after 49 days up time, causing the driver to get an incorrect time.
Replace the unsigned int variable with a ulong type to properly store
the value returned by get_timer.
Signed-off-by: Stanley Chu <yschu@nuvoton.com>
Signed-off-by: Jim Liu <JJLIU0@nuvoton.com>
In comphy_cp110_init_serdes_map in comphy_cp110.c there are two fields
in cfg, comphy_lanes_count and comphy_mux_bitcount, which are fetched
from the FDT blob with fdtdec_get_int which returns an int. These two
fields are then tested for being negative. However the fields are
declared as unsigned so those tests must always fail. Change the
declaration of those fields to be int instead of u32 and the code will
work as expected.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Stefan Roese <stefan.roese@mailbox.org>
The limit checks in get_speed_string and get_type_string are off by 1 as
they do not account for the maximum index into an array that can be used
is 1 less than the number of elements in that array. Adjust the limit
checks to allow for this.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Stefan Roese <stefan.roese@mailbox.org>
In vsc8514_config there is a while loop for detecting a config failure
using a timeout counter with a post-decrement. In the case of a timeout
this will result in the loop exiting with timeout == -1 so use that as
the test below the loop to detect that the timeout occurred.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
In octeontx_smi_probe if an error is detected then memory that was
allocated is not freed. Small refactor of the code to use a common
return and free memory. Also return -ENOMEM for an allocation failure.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In nicvf_cq_handler there is a test for !cqe_count which will return if
true so it is guaranteed that cqe_count will true after that point. This
makes the later test for cqe_count redundant so it can be removed.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
In nicvf_rcv_pkt_handler there is no need to initialise err as it is
assigned to immediately after. Also the test for !pkt will return if
true meaning that pkt is guaranteed to be true after that code block and
so no need to test for it and the redundant test can be removed.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025
page 4581 Figure 104.3b Initial Setting of PCIEC(example) middle
of the figure indicates that fourth write into register 0x148 [2:0]
is 0x3 or GENMASK(1, 0). The current code writes GENMASK(11, 0)
which is a typo. Fix the typo.
Fixes: be3dd0dc2f ("pci: pcie-rcar-gen4: Add Renesas R-Car Gen4 DW PCIe controller driver")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
This driver provides an interface to access the functions of the system
controller on the Microchip PolarFire SoC.
This driver includes functions to use the system controller to read
the device serial number.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Acked-by: Leo Yu-Chi Liang <ycliang@andestech.com>
This driver adds support for the single mailbox channel of the MSS
system controller on the Microchip PolarFire SoC.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Acked-by: Leo Yu-Chi Liang <ycliang@andestech.com>
