Merge tag 'u-boot-dfu-20250410' of https://source.denx.de/u-boot/custodians/u-boot-dfu

u-boot-dfu-20250410

CI:
- https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/25615

Usb gadget:
- Add SAM9X60 support to atmel driver
- Fix memory leaks in f_mass_storage gadget driver
- Fix comment typo in dwc3 gadget driver

Fastboot:
- Lift restrictions on !NET_LWIP for USB

Android:
- Fix possible NULL ptr when AVB is out of memory

arch/arm/mach-at91/include/mach/atmel_usba_udc.h

@@ -20,7 +20,7 @@
 	}
 
 #if defined(CONFIG_AT91SAM9G45) || defined(CONFIG_AT91SAM9M10G45) || \
-	defined(CONFIG_AT91SAM9X5)
+	defined(CONFIG_AT91SAM9X5) || defined(CONFIG_SAM9X60)
 static struct usba_ep_data usba_udc_ep[] = {
 	EP("ep0", 0, 64, 1, 0, 0),
 	EP("ep1", 1, 1024, 2, 1, 1),

boot/bootmeth_android.c

@@ -455,7 +455,8 @@ static int run_avb_verification(struct bootflow *bflow)
 		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
 			printf("Verification failed, reason: %s\n",
 			       str_avb_slot_error(result));
-			avb_slot_verify_data_free(out_data);
+			if (out_data)
+				avb_slot_verify_data_free(out_data);
 			return log_msg_ret("avb verify", -EIO);
 		}
 		boot_state = AVB_GREEN;
@@ -465,7 +466,8 @@ static int run_avb_verification(struct bootflow *bflow)
 		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
 			printf("Unlocked verification failed, reason: %s\n",
 			       str_avb_slot_error(result));
-			avb_slot_verify_data_free(out_data);
+			if (out_data)
+				avb_slot_verify_data_free(out_data);
 			return log_msg_ret("avb verify unlocked", -EIO);
 		}
 		boot_state = AVB_ORANGE;

cmd/fastboot.c

@@ -16,6 +16,7 @@
 #include <linux/printk.h>
 #include <linux/stringify.h>
 
+#if CONFIG_IS_ENABLED(NET)
 static int do_fastboot_udp(int argc, char *const argv[],
 			   uintptr_t buf_addr, size_t buf_size)
 {
@@ -55,6 +56,7 @@ static int do_fastboot_tcp(int argc, char *const argv[],
 
 	return CMD_RET_SUCCESS;
 }
+#endif
 
 static int do_fastboot_usb(int argc, char *const argv[],
 			   uintptr_t buf_addr, size_t buf_size)
@@ -160,10 +162,12 @@ NXTARG:
 
 	fastboot_init((void *)buf_addr, buf_size);
 
+#if CONFIG_IS_ENABLED(NET)
 	if (!strcmp(argv[1], "udp"))
 		return do_fastboot_udp(argc, argv, buf_addr, buf_size);
 	if (!strcmp(argv[1], "tcp"))
 		return do_fastboot_tcp(argc, argv, buf_addr, buf_size);
+#endif
 	if (!strcmp(argv[1], "usb")) {
 		argv++;
 		argc--;

drivers/fastboot/Kconfig

@@ -1,6 +1,5 @@
 menu "Fastboot support"
 	depends on CMDLINE
-	depends on !NET_LWIP
 
 config FASTBOOT
 	bool

drivers/fastboot/fb_common.c

@@ -183,11 +183,15 @@ void fastboot_handle_boot(int command, bool success)
 	switch (command) {
 	case FASTBOOT_COMMAND_BOOT:
 		fastboot_boot();
+#if CONFIG_IS_ENABLED(NET)
 		net_set_state(NETLOOP_SUCCESS);
+#endif
 		break;
 
 	case FASTBOOT_COMMAND_CONTINUE:
+#if CONFIG_IS_ENABLED(NET)
 		net_set_state(NETLOOP_SUCCESS);
+#endif
 		break;
 
 	case FASTBOOT_COMMAND_REBOOT:

drivers/usb/dwc3/gadget.c

@@ -1635,7 +1635,7 @@ usb_ep *dwc3_gadget_match_ep(struct usb_gadget *gadget,
 		/*
 		 * Special workaround for NXP UUU tool in SPL.
 		 *
-		 * The tool excepts the interrupt-in endpoint to be ep1in,
+		 * The tool expects the interrupt-in endpoint to be ep1in,
 		 * otherwise it crashes. This is a result of the previous
 		 * hard-coded EP setup in drivers/usb/gadget/epautoconf.c
 		 * which did special-case EP allocation for SPL builds,

drivers/usb/gadget/atmel_usba_udc.c

@@ -1443,6 +1443,7 @@ static const struct udevice_id usba_udc_ids[] = {
 	{ .compatible = "atmel,at91sam9rl-udc" },
 	{ .compatible = "atmel,at91sam9g45-udc" },
 	{ .compatible = "atmel,sama5d3-udc" },
+	{ .compatible = "microchip,sam9x60-udc" },
 	{}
 };
 

drivers/usb/gadget/f_mass_storage.c

@@ -284,7 +284,6 @@ static const char fsg_string_interface[] = "Mass Storage";
 #define kthread_create(...)	__builtin_return_address(0)
 #define wait_for_completion(...) do {} while (0)
 
-struct kref {int x; };
 struct completion {int x; };
 
 struct fsg_dev;
@@ -345,8 +344,6 @@ struct fsg_common {
 	/* Vendor (8 chars), product (16 chars), release (4
 	 * hexadecimal digits) and NUL byte */
 	char inquiry_string[8 + 16 + 4 + 1];
-
-	struct kref		ref;
 };
 
 struct fsg_config {
@@ -2436,7 +2433,7 @@ int fsg_main_thread(void *common_)
 	return 0;
 }
 
-static void fsg_common_release(struct kref *ref);
+static void fsg_common_release(struct fsg_common *common);
 
 static struct fsg_common *fsg_common_init(struct fsg_common *common,
 					  struct usb_composite_dev *cdev)
@@ -2548,16 +2545,12 @@ error_luns:
 	common->nluns = i + 1;
 error_release:
 	common->state = FSG_STATE_TERMINATED;	/* The thread is dead */
-	/* Call fsg_common_release() directly, ref might be not
-	 * initialised */
-	fsg_common_release(&common->ref);
+	fsg_common_release(common);
 	return ERR_PTR(rc);
 }
 
-static void fsg_common_release(struct kref *ref)
+static void fsg_common_release(struct fsg_common *common)
 {
-	struct fsg_common *common = container_of(ref, struct fsg_common, ref);
-
 	/* If the thread isn't already dead, tell it to exit now */
 	if (common->state != FSG_STATE_TERMINATED) {
 		raise_exception(common, FSG_STATE_EXIT);
@@ -2571,8 +2564,6 @@ static void fsg_common_release(struct kref *ref)
 		/* In error recovery common->nluns may be zero. */
 		for (; i; --i, ++lun)
 			fsg_lun_close(lun);
-
-		kfree(common->luns);
 	}
 
 	{
@@ -2648,6 +2639,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 		raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
 	}
 
+	fsg_common_release(fsg->common);
 	free(fsg->function.descriptors);
 	free(fsg->function.hs_descriptors);
 	kfree(fsg);
@@ -2751,6 +2743,8 @@ int fsg_add(struct usb_configuration *c)
 	struct fsg_common *fsg_common;
 
 	fsg_common = fsg_common_init(NULL, c->cdev);
+	if (IS_ERR(fsg_common))
+		return PTR_ERR(fsg_common);
 
 	fsg_common->vendor_name = 0;
 	fsg_common->product_name = 0;