From 0ed45794ae9fa3bd8adb1f2d85875f93d94249f8 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 12 Aug 2025 12:34:38 +0100 Subject: [PATCH 1/2] spi: cadence_qspi: Off by 1 in test for timeout In cadence_qspi_apb_exec_flash_cmd the test for a timeout uses a post-decrement on the variable retry which will result in a value of -1 after the loop exit, or it would if the variable were signed. To fix this make retry a signed variable and test its value for being equal to -1. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/spi/cadence_qspi_apb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/spi/cadence_qspi_apb.c b/drivers/spi/cadence_qspi_apb.c index 4696c09f754..0d4bc685f5d 100644 --- a/drivers/spi/cadence_qspi_apb.c +++ b/drivers/spi/cadence_qspi_apb.c @@ -354,7 +354,7 @@ void cadence_qspi_apb_controller_init(struct cadence_spi_priv *priv) int cadence_qspi_apb_exec_flash_cmd(void *reg_base, unsigned int reg) { - unsigned int retry = CQSPI_REG_RETRY; + int retry = CQSPI_REG_RETRY; /* Write the CMDCTRL without start execution. */ writel(reg, reg_base + CQSPI_REG_CMDCTRL); @@ -369,7 +369,7 @@ int cadence_qspi_apb_exec_flash_cmd(void *reg_base, unsigned int reg) udelay(1); } - if (!retry) { + if (retry == -1) { printf("QSPI: flash command execution timeout\n"); return -EIO; } From 1a5129d3dafda90914972ce78db20f7eb6bc9fde Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 12 Aug 2025 12:34:39 +0100 Subject: [PATCH 2/2] spi: cadence_qspi: Do not return unset error code In spi_calibration if the low range fails to calibrate then the code attempted to return the variable err but this has not been set in this case. Instead just return -EIO. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/spi/cadence_qspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/cadence_qspi.c b/drivers/spi/cadence_qspi.c index 9edbfaa821b..d8d9a4056fe 100644 --- a/drivers/spi/cadence_qspi.c +++ b/drivers/spi/cadence_qspi.c @@ -142,7 +142,7 @@ static int spi_calibration(struct udevice *bus, uint hz) if (range_lo == -1) { puts("SF: Calibration failed (low range)\n"); - return err; + return -EIO; } /* Disable QSPI for subsequent initialization */