From 377159bfb8ee35ce16200818cfa55cdfba8c69e9 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Thu, 24 Jul 2025 16:32:55 +0100 Subject: [PATCH 01/13] ddr: fsl: Provide initial value for zqcs_init In the case of !zq_en zqcs_init is never assigned to although its value is used. Correct by initialising zqcs_init to 0. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/ddr/fsl/ctrl_regs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ddr/fsl/ctrl_regs.c b/drivers/ddr/fsl/ctrl_regs.c index 9a25192c079..fea08c9000f 100644 --- a/drivers/ddr/fsl/ctrl_regs.c +++ b/drivers/ddr/fsl/ctrl_regs.c @@ -2173,7 +2173,7 @@ static void set_ddr_zq_cntl(fsl_ddr_cfg_regs_t *ddr, unsigned int zq_en) /* Normal Operation Short Calibration Time (tZQCS) */ unsigned int zqcs = 0; #ifdef CONFIG_SYS_FSL_DDR4 - unsigned int zqcs_init; + unsigned int zqcs_init = 0; #endif if (zq_en) { From 44d321f0092a42b2295bd6eac41199604cf7d8c9 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:03:57 +0100 Subject: [PATCH 02/13] net: fm: Correct test for timeout In bmi_rx_port_disable and bmi_tx_port_disable the use of post-decrement on the test in the while loop for a timeout means that timeout will be equal to -1 on exit in that case. Adjust the test for this expected value. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fm/eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/fm/eth.c b/drivers/net/fm/eth.c index 63fe4b2d33c..c83b789693a 100644 --- a/drivers/net/fm/eth.c +++ b/drivers/net/fm/eth.c @@ -169,7 +169,7 @@ static void bmi_rx_port_disable(struct fm_bmi_rx_port *rx_port) /* wait until the rx port is not busy */ while ((in_be32(&rx_port->fmbm_rst) & FMBM_RST_BSY) && timeout--) ; - if (!timeout) + if (timeout == -1) printf("%s - timeout\n", __func__); } @@ -199,7 +199,7 @@ static void bmi_tx_port_disable(struct fm_bmi_tx_port *tx_port) /* wait until the tx port is not busy */ while ((in_be32(&tx_port->fmbm_tst) & FMBM_TST_BSY) && timeout--) ; - if (!timeout) + if (timeout == -1) printf("%s - timeout\n", __func__); } From 270798a4209aeb23fce72ebf10e62630f474e431 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:03:58 +0100 Subject: [PATCH 03/13] net: fm: NULL check dev before dereference In fm_eth_bind there is a dereference of dev before it is NULL checked. Add a NULL check before the first dereference and remove a later NULL check that is now redundant. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fm/eth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/fm/eth.c b/drivers/net/fm/eth.c index c83b789693a..f0e7c0eca42 100644 --- a/drivers/net/fm/eth.c +++ b/drivers/net/fm/eth.c @@ -727,12 +727,15 @@ static int fm_eth_bind(struct udevice *dev) char mac_name[11]; u32 fm, num; + if (!dev) + return -EINVAL; + if (ofnode_read_u32(ofnode_get_parent(dev_ofnode(dev)), "cell-index", &fm)) { printf("FMan node property cell-index missing\n"); return -EINVAL; } - if (dev && dev_read_u32(dev, "cell-index", &num)) { + if (dev_read_u32(dev, "cell-index", &num)) { printf("FMan MAC node property cell-index missing\n"); return -EINVAL; } From 5b95f666fbd8f9c9c43726c7ced229762e4a35e0 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:03:59 +0100 Subject: [PATCH 04/13] net: fm: Correct test for timeout In memac_wait_until_free and memac_wait_until_done the use of post-decrement on the test in the while loop for a timeout means that timeout will be equal to -1 on exit in that case. Adjust the test for this expected value. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fm/memac_phy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/fm/memac_phy.c b/drivers/net/fm/memac_phy.c index 26425d94ae5..1ad3c053593 100644 --- a/drivers/net/fm/memac_phy.c +++ b/drivers/net/fm/memac_phy.c @@ -46,7 +46,7 @@ static int memac_wait_until_free(struct memac_mdio_controller *regs) while ((memac_in_32(®s->mdio_stat) & MDIO_STAT_BSY) && timeout--) ; - if (!timeout) { + if (timeout == -1) { printf("timeout waiting for MDIO bus to be free\n"); return -ETIMEDOUT; } @@ -64,7 +64,7 @@ static int memac_wait_until_done(struct memac_mdio_controller *regs) while ((memac_in_32(®s->mdio_stat) & MDIO_STAT_BSY) && timeout--) ; - if (!timeout) { + if (timeout == -1) { printf("timeout waiting for MDIO operation to complete\n"); return -ETIMEDOUT; } From f4c2a12611d3ffdbd624ededf0fce192f26dddaf Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:56:55 +0100 Subject: [PATCH 05/13] net: fsl_enetc: Fix copy/paste error In netc_blk_ctrl_probe the test for failure of the function clk_prepare_enable should not return PTR_ERR(ipg_clk) as it does not check IS_ERR(ipg_clk) instead it should return err as that is what is holding the error code in this case. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fsl_enetc_netc_blk_ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/fsl_enetc_netc_blk_ctrl.c b/drivers/net/fsl_enetc_netc_blk_ctrl.c index 46b68d3d8a4..fecd66eb15a 100644 --- a/drivers/net/fsl_enetc_netc_blk_ctrl.c +++ b/drivers/net/fsl_enetc_netc_blk_ctrl.c @@ -293,7 +293,7 @@ static int netc_blk_ctrl_probe(struct udevice *dev) err = clk_prepare_enable(ipg_clk); if (err) { dev_err(dev, "Enable ipg clock failed\n"); - return PTR_ERR(ipg_clk); + return err; } regs = dev_read_addr_name(dev, "ierb"); From 756580d090e5dcb3c45d1f0147cc596ae4efd961 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:56:56 +0100 Subject: [PATCH 06/13] net: fsl-mc: NULL check dflt_dpio before dereference In dpio_exit there is a NULL check for dflt_dpio but it happens after dpio_dflt has been dereferenced a number of times already. Instead move the NULL check to first thing in the function. Also assign NULL to dflt_dpio after free in both dpio_init and dpio_exit. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fsl-mc/mc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/fsl-mc/mc.c b/drivers/net/fsl-mc/mc.c index 86daf0fb2bb..999a9912e2f 100644 --- a/drivers/net/fsl-mc/mc.c +++ b/drivers/net/fsl-mc/mc.c @@ -1178,6 +1178,7 @@ err_get_api_ver: dflt_dpio->dpio_id); err_create: free(dflt_dpio); + dflt_dpio = NULL; err_calloc: return err; } @@ -1186,6 +1187,9 @@ static int dpio_exit(void) { int err; + if (!dflt_dpio) + return -ENODEV; + err = dpio_disable(dflt_mc_io, MC_CMD_NO_FLAGS, dflt_dpio->dpio_handle); if (err < 0) { printf("dpio_disable() failed: %d\n", err); @@ -1211,8 +1215,8 @@ static int dpio_exit(void) printf("Exit: DPIO.%d\n", dflt_dpio->dpio_id); #endif - if (dflt_dpio) - free(dflt_dpio); + free(dflt_dpio); + dflt_dpio = NULL; return 0; err: From 9ca756cee7e8f9d6ecc0a69fa785caabd61f3f6a Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:56:57 +0100 Subject: [PATCH 07/13] net: fsl-mc: NULL check dflt_dpbp before dereference In dpbp_exit there is a NULL check for dflt_dpbp after it is dereferenced a number of times. Instead move the NULL check to early in the function. Also assign NULL to dflt_dpbp after free in both dpbp_init and dpbp_exit. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fsl-mc/mc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/fsl-mc/mc.c b/drivers/net/fsl-mc/mc.c index 999a9912e2f..8c882c7fcf5 100644 --- a/drivers/net/fsl-mc/mc.c +++ b/drivers/net/fsl-mc/mc.c @@ -1438,6 +1438,7 @@ err_close: err_open: err_create: free(dflt_dpbp); + dflt_dpbp = NULL; err_calloc: return err; } @@ -1446,6 +1447,9 @@ static int dpbp_exit(void) { int err; + if (!dflt_dpbp) + return -ENODEV; + err = dpbp_destroy(dflt_mc_io, dflt_dprc_handle, MC_CMD_NO_FLAGS, dflt_dpbp->dpbp_id); if (err < 0) { @@ -1457,8 +1461,8 @@ static int dpbp_exit(void) printf("Exit: DPBP.%d\n", dflt_dpbp->dpbp_attr.id); #endif - if (dflt_dpbp) - free(dflt_dpbp); + free(dflt_dpbp); + dflt_dpbp = NULL; return 0; err: From 010a4c5c553763430b3e9628ae2c82de3d5f45dd Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:56:58 +0100 Subject: [PATCH 08/13] net: fsl-mc: NULL check dflt_dpni before dereference In dpni_exit there is a NULL check for dflt_dpni after it is dereferenced a number of times. Instead move the NULL check to early in the function. Also assign NULL to dflt_dpni after free in both dpni_init and dpni_exit. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fsl-mc/mc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/fsl-mc/mc.c b/drivers/net/fsl-mc/mc.c index 8c882c7fcf5..aad852f8151 100644 --- a/drivers/net/fsl-mc/mc.c +++ b/drivers/net/fsl-mc/mc.c @@ -1539,6 +1539,7 @@ err_get_version: dflt_dpni->dpni_id); err_create: free(dflt_dpni); + dflt_dpni = NULL; err_calloc: return err; } @@ -1547,6 +1548,9 @@ static int dpni_exit(void) { int err; + if (!dflt_dpni) + return -ENODEV; + err = dpni_destroy(dflt_mc_io, dflt_dprc_handle, MC_CMD_NO_FLAGS, dflt_dpni->dpni_id); if (err < 0) { @@ -1558,8 +1562,8 @@ static int dpni_exit(void) printf("Exit: DPNI.%d\n", dflt_dpni->dpni_id); #endif - if (dflt_dpni) - free(dflt_dpni); + free(dflt_dpni); + dflt_dpni = NULL; return 0; err: From 05b11146363039a00bff09c77be077ebdaf1f5d0 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 4 Aug 2025 17:56:59 +0100 Subject: [PATCH 09/13] net: fsl-mc: Incorrect variable used in error path In mc_fixup_dpc_mac_addr noff is assigned the return value from fdt_add_subnode so that is the variable that should be passed to fdt_strerror and returned when negative. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/net/fsl-mc/mc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/fsl-mc/mc.c b/drivers/net/fsl-mc/mc.c index aad852f8151..c8ed702f50a 100644 --- a/drivers/net/fsl-mc/mc.c +++ b/drivers/net/fsl-mc/mc.c @@ -366,8 +366,8 @@ static int mc_fixup_dpc_mac_addr(void *blob, int dpmac_id, noff = fdt_add_subnode(blob, nodeoffset, mac_name); if (noff < 0) { printf("fdt_add_subnode: err=%s\n", - fdt_strerror(err)); - return err; + fdt_strerror(noff)); + return noff; } /* add default property of fixed link */ From dc37adfc040877db359abdc7eab19adffb8fc722 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 8 Aug 2025 11:29:33 +0100 Subject: [PATCH 10/13] drivers: qe: avoid double free() Avoid calling free(addr) twice if the device for ucode is not found. This patch repeats a similar fix but that only applied to code without CONFIG_TFABOOT enabled. This patch applies to the code with CONFIG_TFABOOT enabled. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/qe/qe.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/qe/qe.c b/drivers/qe/qe.c index 69b7de084e5..25880db37cf 100644 --- a/drivers/qe/qe.c +++ b/drivers/qe/qe.c @@ -255,7 +255,6 @@ void u_qe_init(void) struct mmc *mmc = find_mmc_device(CONFIG_ENV_MMC_DEVICE_INDEX); if (!mmc) { - free(addr); printf("\nMMC cannot find device for ucode\n"); } else { printf("\nMMC read: dev # %u, block # %u, count %u ...\n", From 4d3183723f34d58cb5decec77e8bf64b84d309d1 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 11 Aug 2025 17:25:17 +0100 Subject: [PATCH 11/13] serial: lpuart: Return value from correct variable In get_lpuart_clk_rate if the call to clk_get_rate returns an error then the call to return should pass the value of the error which is in rate rather than ret which will be 0 as its value is not affected by this error. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Peng Fan --- drivers/serial/serial_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/serial/serial_lpuart.c b/drivers/serial/serial_lpuart.c index 93602797b83..9fdb6503085 100644 --- a/drivers/serial/serial_lpuart.c +++ b/drivers/serial/serial_lpuart.c @@ -129,7 +129,7 @@ static int get_lpuart_clk_rate(struct udevice *dev, u32 *clk_rate) rate = clk_get_rate(&clk); if ((long)rate <= 0) { dev_err(dev, "Failed to get clk rate: %ld\n", (long)rate); - return ret; + return rate; } *clk_rate = rate; return 0; From 1363f9c1a0652448687a4a457507881aa1670ba2 Mon Sep 17 00:00:00 2001 From: Tomas Alvarez Vanoli Date: Wed, 20 Aug 2025 10:17:19 +0200 Subject: [PATCH 12/13] fsl_dspi: set scaler values for CS-SCK and SCK-CS delays These values were calculated but not set. They are required for the calculation of the delays, as stated in the "QorIQ LS1043A Reference Manual, Rev. 6, 07/2020" page 2172. The delays are calculated as (1/freq)*PCSSCK*CSSCK and (1/freq)*PASC*ASC. Signed-off-by: Tomas Alvarez Vanoli Reviewed-by: Vladimir Oltean Signed-off-by: Peng Fan --- drivers/spi/fsl_dspi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/spi/fsl_dspi.c b/drivers/spi/fsl_dspi.c index 545561ad116..412993ad377 100644 --- a/drivers/spi/fsl_dspi.c +++ b/drivers/spi/fsl_dspi.c @@ -473,7 +473,9 @@ static int fsl_dspi_child_pre_probe(struct udevice *dev) priv->ctar_val[slave_plat->cs[0]] = DSPI_CTAR_DEFAULT_VALUE | DSPI_CTAR_PCSSCK(pcssck) | - DSPI_CTAR_PASC(pasc); + DSPI_CTAR_CSSCK(cssck) | + DSPI_CTAR_PASC(pasc) | + DSPI_CTAR_ASC(asc); debug("DSPI pre_probe slave device on CS %u, max_hz %u, mode 0x%x.\n", slave_plat->cs[0], slave_plat->max_hz, slave_plat->mode); From 8b97d7569a48d15949cc9274f40bae013e24a2a4 Mon Sep 17 00:00:00 2001 From: "Anthony Pighin (Nokia)" Date: Wed, 27 Aug 2025 16:12:21 +0800 Subject: [PATCH 13/13] drivers: crypto: fsl: rng: Reinitialize job ring u-boot internals were being corrupted following an EFI callback to get_rng(). One of the many footprints was a corruption of the EFI protocols linked list. A request for >16 bytes of random data is broken into smaller requests. Those requests are fed in a loop to the CAAM RNG, which uses a job queue ring for interaction. However, the job queue descriptor is created only at probe time. That descriptor may end up needing an endian swap (LS1046A) before being fed to the CAAM RNG. This corrupts the descriptor for the next iteration, since it will be blindly endian swapped yet again. Two issues arise. The number of words to endian swap is taken from the input descriptor itself. So on the second iteration, the length has been corrupted. This results in a corruption past the end of the descriptor: whatever is after in memory is endian swapped too. Second, some of the entries in the descriptor are DMA addresses. If the descriptor is still somehow considered valid after swapping, the data at the corrupted DMA address is now trampled. Linux properly initializes the descriptor for each iteration. This is what is now done with this commit. Signed-off-by: Anthony Pighin Signed-off-by: Peng Fan --- drivers/crypto/fsl/rng.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/fsl/rng.c b/drivers/crypto/fsl/rng.c index 786a710f5fb..06f37a8b4de 100644 --- a/drivers/crypto/fsl/rng.c +++ b/drivers/crypto/fsl/rng.c @@ -23,11 +23,26 @@ struct caam_rng_priv { u8 data[CAAM_RNG_MAX_FIFO_STORE_SIZE] __aligned(ARCH_DMA_MINALIGN); }; +static int caam_init_desc(struct caam_rng_priv *priv) +{ + ulong size = ALIGN(CAAM_RNG_DESC_LEN, ARCH_DMA_MINALIGN); + + inline_cnstr_jobdesc_rng(priv->desc, priv->data, + CAAM_RNG_MAX_FIFO_STORE_SIZE); + + flush_dcache_range((unsigned long)priv->desc, + (unsigned long)priv->desc + size); + + return 0; +} + static int caam_rng_read_one(struct caam_rng_priv *priv) { int size = ALIGN(CAAM_RNG_MAX_FIFO_STORE_SIZE, ARCH_DMA_MINALIGN); int ret; + caam_init_desc(priv); + ret = run_descriptor_jr(priv->desc); if (ret < 0) return -EIO; @@ -63,12 +78,8 @@ static int caam_rng_read(struct udevice *dev, void *data, size_t len) static int caam_rng_probe(struct udevice *dev) { struct caam_rng_priv *priv = dev_get_priv(dev); - ulong size = ALIGN(CAAM_RNG_DESC_LEN, ARCH_DMA_MINALIGN); - inline_cnstr_jobdesc_rng(priv->desc, priv->data, - CAAM_RNG_MAX_FIFO_STORE_SIZE); - flush_dcache_range((unsigned long)priv->desc, - (unsigned long)priv->desc + size); + caam_init_desc(priv); return 0; }