Merge tag 'qcom-fixes-13Aug2025' of https://source.denx.de/u-boot/custodians/u-boot-snapdragon

CI: https://source.denx.de/u-boot/custodians/u-boot-snapdragon/-/pipelines/27364

Quite a few Smatch issues reported by Andrew, and the LMB allocation
fix.

6 files changed, 32 insertions, 25 deletions

diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
index fc921a4be26..5fb3240acc5 100644
--- a/arch/arm/mach-snapdragon/board.c
+++ b/arch/arm/mach-snapdragon/board.c
@@ -534,8 +534,7 @@ int board_late_init(void)
 		env_set_hex("ramdisk_addr_r", addr) : 1;
 	status |= !lmb_alloc(KERNEL_COMP_SIZE, &addr) ?
 		env_set_hex("kernel_comp_addr_r", addr) : 1;
-	status |= !lmb_alloc(KERNEL_COMP_SIZE, &addr) ?
-		env_set_hex("kernel_comp_size", addr) : 1;
+	status |= env_set_hex("kernel_comp_size", KERNEL_COMP_SIZE);
 	status |= !lmb_alloc(SZ_4M, &addr) ?
 		env_set_hex("scriptaddr", addr) : 1;
 	status |= !lmb_alloc(SZ_4M, &addr) ?
@@ -544,9 +543,13 @@ int board_late_init(void)
 	if (IS_ENABLED(CONFIG_FASTBOOT)) {
 		status |= !lmb_alloc(FASTBOOT_BUF_SIZE, &addr) ?
 			env_set_hex("fastboot_addr_r", addr) : 1;
-		/* override loadaddr for memory rich soc */
-		status |= !lmb_alloc(SZ_128M, &addr) ?
-			env_set_hex("loadaddr", addr) : 1;
+		/*
+		 * Override loadaddr for memory rich soc since ${loadaddr} and
+		 * ${kernel_addr_r} need to be different for the Android boot image
+		 * flow. It's typically safe for ${loadaddr} to be the same address
+		 * as the fastboot buffer.
+		 */
+		status |= env_set_hex("loadaddr", addr);
 	}
 
 	fdt_status |= !lmb_alloc(SZ_2M, &addr) ?
diff --git a/drivers/button/button-qcom-pmic.c b/drivers/button/button-qcom-pmic.c
index 85addfe32a2..b823490d6d5 100644
--- a/drivers/button/button-qcom-pmic.c
+++ b/drivers/button/button-qcom-pmic.c
@@ -195,8 +195,9 @@ static int button_qcom_pmic_bind(struct udevice *parent)
 			continue;
 		}
 
+		label = ofnode_get_name(node);
 		ret = device_bind_driver_to_node(parent, "qcom_pwrkey",
-						 ofnode_get_name(node),
+						 label,
 						 node, &dev);
 		if (ret) {
 			printf("Failed to bind %s! %d\n", label, ret);
diff --git a/drivers/phy/qcom/phy-qcom-snps-eusb2.c b/drivers/phy/qcom/phy-qcom-snps-eusb2.c
index b2655ac007c..28502c46f67 100644
--- a/drivers/phy/qcom/phy-qcom-snps-eusb2.c
+++ b/drivers/phy/qcom/phy-qcom-snps-eusb2.c
@@ -331,8 +331,9 @@ static int qcom_snps_eusb2_phy_probe(struct udevice *dev)
 
 	qcom_snps_eusb2->ref_clk = devm_clk_get(dev, "ref");
 	if (IS_ERR(qcom_snps_eusb2->ref_clk)) {
+		ret = PTR_ERR(qcom_snps_eusb2->ref_clk);
 		printf("%s: failed to get ref clk %d\n", __func__, ret);
-		return PTR_ERR(qcom_snps_eusb2->ref_clk);
+		return ret;
 	}
 
 	ret = reset_get_bulk(dev, &qcom_snps_eusb2->resets);
diff --git a/drivers/pinctrl/qcom/pinctrl-sa8775p.c b/drivers/pinctrl/qcom/pinctrl-sa8775p.c
index cb2496ff1fb..d4acae15d55 100644
--- a/drivers/pinctrl/qcom/pinctrl-sa8775p.c
+++ b/drivers/pinctrl/qcom/pinctrl-sa8775p.c
@@ -516,7 +516,9 @@ static const char *sa8775p_get_function_name(struct udevice *dev,
 static const char *sa8775p_get_pin_name(struct udevice *dev,
 					unsigned int selector)
 {
-	if (selector >= 149 && selector <= 155)
+	if (selector > 153)
+		strcpy(pin_name, "unknown");
+	else if (selector >= 149)
 		snprintf(pin_name, MAX_PIN_NAME_LEN,
 			 msm_special_pins_data[selector - 149].name);
 	else
diff --git a/drivers/pinctrl/qcom/pinctrl-sdm845.c b/drivers/pinctrl/qcom/pinctrl-sdm845.c
index 3f55fc81c8e..24b42e94c7a 100644
--- a/drivers/pinctrl/qcom/pinctrl-sdm845.c
+++ b/drivers/pinctrl/qcom/pinctrl-sdm845.c
@@ -72,7 +72,7 @@ static const char *sdm845_get_pin_name(struct udevice *dev,
 		"sdc2_data",
 	};
 
-	if (selector >= 150 && selector <= 154)
+	if (selector >= 150 && selector <= 153)
 		snprintf(pin_name, MAX_PIN_NAME_LEN, special_pins_names[selector - 150]);
 	else
 		snprintf(pin_name, MAX_PIN_NAME_LEN, "gpio%u", selector);
diff --git a/drivers/serial/serial_msm_geni.c b/drivers/serial/serial_msm_geni.c
index cb6c09fdd09..0eb90f82a34 100644
--- a/drivers/serial/serial_msm_geni.c
+++ b/drivers/serial/serial_msm_geni.c
@@ -252,6 +252,10 @@ static int msm_serial_setbrg(struct udevice *dev, int baud)
 	priv->baud = baud;
 
 	clk_rate = get_clk_div_rate(baud, priv->oversampling, &clk_div);
+	if (!clk_rate) {
+		pr_err("%s: Couldn't get clock division rate\n", __func__);
+		return -EINVAL;
+	}
 	ret = geni_serial_set_clock_rate(dev, clk_rate);
 	if (ret < 0) {
 		pr_err("%s: Couldn't set clock rate: %d\n", __func__, ret);
@@ -284,23 +288,19 @@ static bool qcom_geni_serial_poll_bit(const struct udevice *dev, int offset,
 	unsigned int tx_fifo_depth;
 	unsigned int tx_fifo_width;
 	unsigned int fifo_bits;
-	unsigned long timeout_us = 10000;
-
-	baud = 115200;
+	unsigned long timeout_us;
 
-	if (priv) {
-		baud = priv->baud;
-		if (!baud)
-			baud = 115200;
-		tx_fifo_depth = geni_se_get_tx_fifo_depth(priv->base);
-		tx_fifo_width = geni_se_get_tx_fifo_width(priv->base);
-		fifo_bits = tx_fifo_depth * tx_fifo_width;
-		/*
-		 * Total polling iterations based on FIFO worth of bytes to be
-		 * sent at current baud. Add a little fluff to the wait.
-		 */
-		timeout_us = ((fifo_bits * USEC_PER_SEC) / baud) + 500;
-	}
+	baud = priv->baud;
+	if (!baud)
+		baud = 115200;
+	tx_fifo_depth = geni_se_get_tx_fifo_depth(priv->base);
+	tx_fifo_width = geni_se_get_tx_fifo_width(priv->base);
+	fifo_bits = tx_fifo_depth * tx_fifo_width;
+	/*
+	 * Total polling iterations based on FIFO worth of bytes to be
+	 * sent at current baud. Add a little fluff to the wait.
+	 */
+	timeout_us = ((fifo_bits * USEC_PER_SEC) / baud) + 500;
 
 	timeout_us = DIV_ROUND_UP(timeout_us, 10) * 10;
 	while (timeout_us) {