From 45eedb7b8097793242c542b68bc5d37b298808b7 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 16:45:47 +0100 Subject: net: octeontx: Remove unneeded code In nicvf_rcv_pkt_handler there is no need to initialise err as it is assigned to immediately after. Also the test for !pkt will return if true meaning that pkt is guaranteed to be true after that code block and so no need to test for it and the redundant test can be removed. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/octeontx/nicvf_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/net/octeontx/nicvf_main.c b/drivers/net/octeontx/nicvf_main.c index 27d0327c88a..8021cd752b5 100644 --- a/drivers/net/octeontx/nicvf_main.c +++ b/drivers/net/octeontx/nicvf_main.c @@ -232,7 +232,7 @@ static int nicvf_rcv_pkt_handler(struct nicvf *nic, size_t pkt_len; struct cqe_rx_t *cqe_rx = (struct cqe_rx_t *)cq_desc; - int err = 0; + int err; /* Check for errors */ err = nicvf_check_cqe_rx_errs(nic, cq, cq_desc); @@ -245,8 +245,7 @@ static int nicvf_rcv_pkt_handler(struct nicvf *nic, return -1; } - if (pkt) - *ppkt = pkt; + *ppkt = pkt; return pkt_len; } -- cgit v1.2.3 From 62b4a482b943bc8173ac10a6c783e84d939b88bf Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 16:45:48 +0100 Subject: net: octeontx: Remove unneeded test In nicvf_cq_handler there is a test for !cqe_count which will return if true so it is guaranteed that cqe_count will true after that point. This makes the later test for cqe_count redundant so it can be removed. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/octeontx/nicvf_main.c | 46 +++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 24 deletions(-) (limited to 'drivers') diff --git a/drivers/net/octeontx/nicvf_main.c b/drivers/net/octeontx/nicvf_main.c index 8021cd752b5..94e5d827614 100644 --- a/drivers/net/octeontx/nicvf_main.c +++ b/drivers/net/octeontx/nicvf_main.c @@ -273,31 +273,29 @@ int nicvf_cq_handler(struct nicvf *nic, void **ppkt, int *pkt_len) cqe_head >>= 9; cqe_head &= 0xFFFF; - if (cqe_count) { - /* Get the CQ descriptor */ - cq_desc = (struct cqe_rx_t *)GET_CQ_DESC(cq, cqe_head); - cqe_head++; - cqe_head &= (cq->dmem.q_len - 1); - - switch (cq_desc->cqe_type) { - case CQE_TYPE_RX: - debug("%s: Got Rx CQE\n", nic->dev->name); - *pkt_len = nicvf_rcv_pkt_handler(nic, cq, cq_desc, - ppkt, CQE_TYPE_RX); - processed_rq_cqe++; - break; - case CQE_TYPE_SEND: - debug("%s: Got Tx CQE\n", nic->dev->name); - nicvf_snd_pkt_handler(nic, cq, cq_desc, CQE_TYPE_SEND); - processed_sq_cqe++; - break; - default: - debug("%s: Got CQ type %u\n", nic->dev->name, - cq_desc->cqe_type); - break; - } - processed_cqe++; + /* Get the CQ descriptor */ + cq_desc = (struct cqe_rx_t *)GET_CQ_DESC(cq, cqe_head); + cqe_head++; + cqe_head &= (cq->dmem.q_len - 1); + + switch (cq_desc->cqe_type) { + case CQE_TYPE_RX: + debug("%s: Got Rx CQE\n", nic->dev->name); + *pkt_len = nicvf_rcv_pkt_handler(nic, cq, cq_desc, + ppkt, CQE_TYPE_RX); + processed_rq_cqe++; + break; + case CQE_TYPE_SEND: + debug("%s: Got Tx CQE\n", nic->dev->name); + nicvf_snd_pkt_handler(nic, cq, cq_desc, CQE_TYPE_SEND); + processed_sq_cqe++; + break; + default: + debug("%s: Got CQ type %u\n", nic->dev->name, + cq_desc->cqe_type); + break; } + processed_cqe++; /* Dequeue CQE */ nicvf_queue_reg_write(nic, NIC_QSET_CQ_0_7_DOOR, -- cgit v1.2.3 From 0ce7fef9e2154d188bd50ae687fb666faac8fe7b Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 16:45:49 +0100 Subject: net: octeontx: Free allocated memory on error In octeontx_smi_probe if an error is detected then memory that was allocated is not freed. Small refactor of the code to use a common return and free memory. Also return -ENOMEM for an allocation failure. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/octeontx/smi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/net/octeontx/smi.c b/drivers/net/octeontx/smi.c index 233c26f7319..217bcac2ce2 100644 --- a/drivers/net/octeontx/smi.c +++ b/drivers/net/octeontx/smi.c @@ -338,7 +338,8 @@ int octeontx_smi_probe(struct udevice *dev) if (!bus || !priv) { printf("Failed to allocate OcteonTX MDIO bus # %u\n", dev_seq(dev)); - return -1; + ret = -ENOMEM; + goto error_ret; } bus->read = octeontx_phy_read; @@ -355,9 +356,16 @@ int octeontx_smi_probe(struct udevice *dev) ret = mdio_register(bus); if (ret) - return ret; + goto error_ret; } return 0; + +error_ret: + if (bus) + free(bus); + if (priv) + free(priv); + return ret; } static const struct udevice_id octeontx_smi_ids[] = { -- cgit v1.2.3 From 4b2d64f3885a83fd001993785f74f70cc6045acc Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 6 Aug 2025 10:37:26 +0100 Subject: net: phy: vitesse: Fix incorrect test for timeout In vsc8514_config there is a while loop for detecting a config failure using a timeout counter with a post-decrement. In the case of a timeout this will result in the loop exiting with timeout == -1 so use that as the test below the loop to detect that the timeout occurred. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Quentin Schulz --- drivers/net/phy/vitesse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c index 4867d1931b4..821d3878236 100644 --- a/drivers/net/phy/vitesse.c +++ b/drivers/net/phy/vitesse.c @@ -239,7 +239,7 @@ static int vsc8514_config(struct phy_device *phydev) while ((val & MIIM_VSC8514_18G_CMDSTAT) && timeout--) val = phy_read(phydev, MDIO_DEVAD_NONE, MIIM_VSC8514_GENERAL18); - if (0 == timeout) { + if (timeout == -1) { printf("PHY 8514 config failed\n"); return -1; } -- cgit v1.2.3 From a75c8a4b883108edf19127fca3e6c6c590f9ba8c Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 6 Aug 2025 17:43:24 +0100 Subject: phy: marvell: Fix off by 1 limit checks The limit checks in get_speed_string and get_type_string are off by 1 as they do not account for the maximum index into an array that can be used is 1 less than the number of elements in that array. Adjust the limit checks to allow for this. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Stefan Roese --- drivers/phy/marvell/comphy_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/phy/marvell/comphy_core.c b/drivers/phy/marvell/comphy_core.c index a666a4e794e..a4121423873 100644 --- a/drivers/phy/marvell/comphy_core.c +++ b/drivers/phy/marvell/comphy_core.c @@ -28,7 +28,7 @@ static const char *get_speed_string(u32 speed) "10.3125 Gbps" }; - if (speed < 0 || speed > COMPHY_SPEED_MAX) + if (speed < 0 || speed >= COMPHY_SPEED_MAX) return "invalid"; return speed_strings[speed]; @@ -44,7 +44,7 @@ static const char *get_type_string(u32 type) "IGNORE" }; - if (type < 0 || type > COMPHY_TYPE_MAX) + if (type < 0 || type >= COMPHY_TYPE_MAX) return "invalid"; return type_strings[type]; -- cgit v1.2.3 From 2e9155cb9f366a6b9191af0850efad1948b4c785 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Wed, 6 Aug 2025 17:43:25 +0100 Subject: phy: marvell: Cannot test unsigned field to be negative In comphy_cp110_init_serdes_map in comphy_cp110.c there are two fields in cfg, comphy_lanes_count and comphy_mux_bitcount, which are fetched from the FDT blob with fdtdec_get_int which returns an int. These two fields are then tested for being negative. However the fields are declared as unsigned so those tests must always fail. Change the declaration of those fields to be int instead of u32 and the code will work as expected. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Stefan Roese --- drivers/phy/marvell/comphy_core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/phy/marvell/comphy_core.h b/drivers/phy/marvell/comphy_core.h index f3d04939387..086a4d82f26 100644 --- a/drivers/phy/marvell/comphy_core.h +++ b/drivers/phy/marvell/comphy_core.h @@ -47,8 +47,8 @@ struct chip_serdes_phy_config { int (*rx_training)(struct chip_serdes_phy_config *, u32); void __iomem *comphy_base_addr; void __iomem *hpipe3_base_addr; - u32 comphy_lanes_count; - u32 comphy_mux_bitcount; + int comphy_lanes_count; + int comphy_mux_bitcount; const fdt32_t *comphy_mux_lane_order; u32 cp_index; struct comphy_map comphy_map_data[MAX_LANE_OPTIONS]; -- cgit v1.2.3 From 59ec495f6c645c80d934034ffe48adb2ea75839a Mon Sep 17 00:00:00 2001 From: Jim Liu Date: Thu, 7 Aug 2025 13:28:32 +0800 Subject: net: designware: Fix get_timer value overflow get_timer returns a ulong value representing system time in ms. On a 64-bit system, this ulong value is 64 bits long. However, the driver stores it in a 32-bit unsigned integer, which overflows after 49 days up time, causing the driver to get an incorrect time. Replace the unsigned int variable with a ulong type to properly store the value returned by get_timer. Signed-off-by: Stanley Chu Signed-off-by: Jim Liu --- drivers/net/designware.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/net/designware.c b/drivers/net/designware.c index fce3ef910cb..7ecedc3d7f0 100644 --- a/drivers/net/designware.c +++ b/drivers/net/designware.c @@ -486,7 +486,7 @@ static int dw_adjust_link(struct dw_eth_dev *priv, struct eth_mac_regs *mac_p, #ifdef CONFIG_ARCH_NPCM8XX if (phydev->interface == PHY_INTERFACE_MODE_SGMII) { - unsigned int start; + ulong start; /* Indirect access to VR_MII_MMD registers */ writew((VR_MII_MMD >> 9), PCS_BA + PCS_IND_AC); @@ -532,7 +532,7 @@ int designware_eth_init(struct dw_eth_dev *priv, u8 *enetaddr) { struct eth_mac_regs *mac_p = priv->mac_regs_p; struct eth_dma_regs *dma_p = priv->dma_regs_p; - unsigned int start; + ulong start; int ret; writel(readl(&dma_p->busmode) | DMAMAC_SRST, &dma_p->busmode); -- cgit v1.2.3 From 0cabbe3235ba91f84495095a7bec693338b3c521 Mon Sep 17 00:00:00 2001 From: Jim Liu Date: Thu, 7 Aug 2025 13:29:31 +0800 Subject: net: phy: broadcom: add support for BCM54612E It's Broadcom PHY simply described as single-port RGMII 10/100/1000BASE-T PHY. Signed-off-by: Jim Liu --- drivers/net/phy/broadcom.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'drivers') diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c index 0a49015eb89..1c02e3efedc 100644 --- a/drivers/net/phy/broadcom.c +++ b/drivers/net/phy/broadcom.c @@ -134,6 +134,33 @@ static void bcm_phy_write_misc(struct phy_device *phydev, phy_write(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_DATA, value); } +/* Broadcom BCM54612E */ +static int bcm54612e_config(struct phy_device *phydev) +{ + u32 reg = 0; + + genphy_config_aneg(phydev); + + phy_reset(phydev); + + /* 125Mhz Clock Output Enable */ + reg = phy_read(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_SEL); + reg |= 0xD34; + phy_write(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_SEL, reg); + + reg = phy_read(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_DATA); + reg |= (1 << 1); + phy_write(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_DATA, reg); + + reg = phy_read(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_SEL); + reg &= 0xfffff000; + phy_write(phydev, MDIO_DEVAD_NONE, MIIM_BCM54XX_EXP_SEL, reg); + + genphy_restart_aneg(phydev); + + return 0; +} + /* Broadcom BCM5461S */ static int bcm5461_config(struct phy_device *phydev) { @@ -434,6 +461,16 @@ U_BOOT_PHY_DRIVER(bcm5461s) = { .shutdown = &genphy_shutdown, }; +U_BOOT_PHY_DRIVER(bcm54612e) = { + .name = "Broadcom BCM54612E", + .uid = 0x03625e6a, + .mask = 0xfffff0, + .features = PHY_GBIT_FEATURES, + .config = &bcm54612e_config, + .startup = &bcm54xx_startup, + .shutdown = &genphy_shutdown, +}; + U_BOOT_PHY_DRIVER(bcm5464s) = { .name = "Broadcom BCM5464S", .uid = 0x2060b0, -- cgit v1.2.3 From ed3b08874f4c47e287a1f0eb36fc61ff7d778cc9 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 11:52:00 +0100 Subject: net: ldpaa_eth: Fix buffer overflow in memset In ldpaa_eth_open a memset is used to initialise a struct to 0 but the size passed is that of a different struct. Correct to pass the sizeof the struct that is being initialised. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/ldpaa_eth/ldpaa_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/ldpaa_eth/ldpaa_eth.c b/drivers/net/ldpaa_eth/ldpaa_eth.c index b72198ca530..94e62748239 100644 --- a/drivers/net/ldpaa_eth/ldpaa_eth.c +++ b/drivers/net/ldpaa_eth/ldpaa_eth.c @@ -458,7 +458,7 @@ static int ldpaa_eth_open(struct udevice *dev) link_state.up == 1 ? printf("up\n") : printf("error state\n"); #endif - memset(&d_queue, 0, sizeof(struct dpni_queue)); + memset(&d_queue, 0, sizeof(struct dpni_queue_id)); err = dpni_get_queue(dflt_mc_io, MC_CMD_NO_FLAGS, dflt_dpni->dpni_handle, DPNI_QUEUE_RX, 0, 0, &d_queue_cfg, &d_queue); -- cgit v1.2.3 From ff36afe346777f60c461964de1ab00aa6b2edb95 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 12:04:00 +0100 Subject: net: mediatek: Use correct variable for return In mtk_eth_of_to_plat, the last error check has the value in 'priv->phy_addr' but returns ret. Correct to return 'priv->phy_addr' instead. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/mtk_eth/mtk_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/mtk_eth/mtk_eth.c b/drivers/net/mtk_eth/mtk_eth.c index 5d6a42bceb4..b172838ba3a 100644 --- a/drivers/net/mtk_eth/mtk_eth.c +++ b/drivers/net/mtk_eth/mtk_eth.c @@ -1461,7 +1461,7 @@ static int mtk_eth_of_to_plat(struct udevice *dev) priv->phy_addr = ofnode_read_s32_default(args.node, "reg", -1); if (priv->phy_addr < 0) { printf("error: phy address is not specified\n"); - return ret; + return priv->phy_addr; } } -- cgit v1.2.3 From 34bc71f2db6bcd83b718ac9c28c39bd7d788a356 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 12:14:14 +0100 Subject: net: mv88e6xxx: Fix logical operator instead of bitwise In mv88e6xxx_port_enable when attempting to mask out the previous settings of two bits a logical operator was used instead of a bitwise operator. Fix this. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/mv88e6xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/mv88e6xxx.c b/drivers/net/mv88e6xxx.c index 557b6b2c8f6..f06c73c20f8 100644 --- a/drivers/net/mv88e6xxx.c +++ b/drivers/net/mv88e6xxx.c @@ -631,7 +631,7 @@ static int mv88e6xxx_port_enable(struct udevice *dev, int port, struct phy_devic dev_dbg(dev, "configure internal RGMII delays\n"); /* RGMII delays */ - val &= ~(PORT_REG_PHYS_CTRL_RGMII_DELAY_RXCLK || + val &= ~(PORT_REG_PHYS_CTRL_RGMII_DELAY_RXCLK | PORT_REG_PHYS_CTRL_RGMII_DELAY_TXCLK); if (phy->interface == PHY_INTERFACE_MODE_RGMII_ID || phy->interface == PHY_INTERFACE_MODE_RGMII_RXID) -- cgit v1.2.3 From b24c89affd9063c3f9f3ca99db075bd3bb1fc4b2 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 15:18:16 +0100 Subject: net: mvpp2: Fix impossible test You cannot test an unsigned char to be >= 256. Instead make the variables start and end to be ints. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/mvpp2.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/net/mvpp2.c b/drivers/net/mvpp2.c index 184c1f9a46a..c0328345973 100644 --- a/drivers/net/mvpp2.c +++ b/drivers/net/mvpp2.c @@ -1722,8 +1722,7 @@ static struct mvpp2_prs_entry *mvpp2_prs_flow_find(struct mvpp2 *priv, int flow) } /* Return first free tcam index, seeking from start to end */ -static int mvpp2_prs_tcam_first_free(struct mvpp2 *priv, unsigned char start, - unsigned char end) +static int mvpp2_prs_tcam_first_free(struct mvpp2 *priv, int start, int end) { int tid; -- cgit v1.2.3 From 6781b90f89b427ec9445c43f8102ebe0a4330e54 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 15:18:17 +0100 Subject: net: mvpp2: Return -ENOMEM for failed alloc Instead of returning -1 on a failed alloc, return -ENOMEM. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/mvpp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/mvpp2.c b/drivers/net/mvpp2.c index c0328345973..b68d305a0dc 100644 --- a/drivers/net/mvpp2.c +++ b/drivers/net/mvpp2.c @@ -2329,7 +2329,7 @@ static int mvpp2_prs_mac_da_accept(struct mvpp2 *priv, int port, pe = kzalloc(sizeof(*pe), GFP_KERNEL); if (!pe) - return -1; + return -ENOMEM; mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_MAC); pe->index = tid; -- cgit v1.2.3 From 3aa3d37282414ea5c19ea415f46d214f4c80d8b6 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 15:18:18 +0100 Subject: net: mvpp2: Cannot test unsigned variable to be negative In phy_info_parse all uses of the variable phyaddr are as an int so declaring as u32 is not useful and prevents the test for an error return from fdtdec_get_int ever detecting an error. Change phyaddr to be an int. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/mvpp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/mvpp2.c b/drivers/net/mvpp2.c index b68d305a0dc..3a3510f603a 100644 --- a/drivers/net/mvpp2.c +++ b/drivers/net/mvpp2.c @@ -4734,7 +4734,7 @@ static int phy_info_parse(struct udevice *dev, struct mvpp2_port *port) int port_node = dev_of_offset(dev); int phy_node; u32 id; - u32 phyaddr = 0; + int phyaddr = 0; int fixed_link = 0; int ret; -- cgit v1.2.3 From c6561a467c9f9a77717ddc2ef296866a4d8a6843 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 15:18:19 +0100 Subject: net: mvpp2: Use field just assigned in error test In mvpp2_probe the code attempts to get a value for "gop-port-id" and assigns it to port->gop_id but it then tests port->id for being equal to -1. That is an impossible test as port->id is a field of type u8 so cannot be negative. Change the test to port->gop_id. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/mvpp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/mvpp2.c b/drivers/net/mvpp2.c index 3a3510f603a..f9e979c4d58 100644 --- a/drivers/net/mvpp2.c +++ b/drivers/net/mvpp2.c @@ -5353,7 +5353,7 @@ static int mvpp2_probe(struct udevice *dev) } else { port->gop_id = fdtdec_get_int(gd->fdt_blob, dev_of_offset(dev), "gop-port-id", -1); - if (port->id == -1) { + if (port->gop_id == -1) { dev_err(dev, "missing gop-port-id value\n"); return -EINVAL; } -- cgit v1.2.3 From 6bc6fec3b33f3c14f14493783db9258ac9938062 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 15:53:34 +0100 Subject: net: octeontx2: Restore default value for err In nix_lf_setup there is a default value assigned to err in case an error is detected. However this default value will be overwritten in the for loop so that later code does not return an error code from the function. Add a new assignment to restore err to the default error code. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/octeontx2/nix.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers') diff --git a/drivers/net/octeontx2/nix.c b/drivers/net/octeontx2/nix.c index f596b6bca87..87d1f7a5dbf 100644 --- a/drivers/net/octeontx2/nix.c +++ b/drivers/net/octeontx2/nix.c @@ -298,6 +298,8 @@ int nix_lf_setup(struct nix *nix) goto error; } + err = -1; + /* Alloc memory for Qints HW contexts */ nix->qint_base = nix_memalloc(nix_af->qints, nix_af->qint_ctx_sz, "Qint CTX"); -- cgit v1.2.3 From 425f9839f3c2922a36efaefa53833f0abe681be0 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 15:53:35 +0100 Subject: net: octeontx2: NULL check before dereference In rvu_af_init if the code fails to allocate memory for nix_af it will take the error path with nix_af == NULL which will dereference nix_af. Add the appropriate NULL check. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/octeontx2/rvu_af.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/octeontx2/rvu_af.c b/drivers/net/octeontx2/rvu_af.c index 0d3a9ffe9ee..7bdfbc52e3b 100644 --- a/drivers/net/octeontx2/rvu_af.c +++ b/drivers/net/octeontx2/rvu_af.c @@ -114,7 +114,7 @@ struct nix_af *rvu_af_init(struct rvu_af *rvu_af) return nix_af; error: - if (nix_af->npa_af) { + if (nix_af && nix_af->npa_af) { free(nix_af->npa_af); memset(nix_af, 0, sizeof(*nix_af)); } -- cgit v1.2.3 From 2cb9fef65bbb7535c1e27cef3122bb0b43e38b68 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 1 Aug 2025 12:59:40 +0100 Subject: net: cortina_ni: Fix typo accessing wrong phy In ca_phy_probe when checking for an external phy it uses a field from the internal phy due to what is assumed to be a copy/paste typo. Make the obvious fix to use the field from the external phy. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/cortina_ni.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/net/cortina_ni.c b/drivers/net/cortina_ni.c index 79026882800..21b7089176c 100644 --- a/drivers/net/cortina_ni.c +++ b/drivers/net/cortina_ni.c @@ -499,7 +499,7 @@ static int ca_phy_probe(struct udevice *dev) dev, priv->phy_interface); if (ext_phydev) { ext_phydev->supported &= PHY_GBIT_FEATURES; - ext_phydev->advertising = int_phydev->supported; + ext_phydev->advertising = ext_phydev->supported; phy_config(ext_phydev); } else { printf("CA NI %s: There is no external phy device\n", __func__); -- cgit v1.2.3 From 5deb50f749659746233e08060b457c9cf9986f9c Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Tue, 5 Aug 2025 11:34:29 +0100 Subject: net: ks8851_mll: Remove unreachable code In ks8851_mll_detect_chip the if..else code detects the case of (val & 0xfff0) != CIDER_ID and returns if found. So testing for this again will always fail and the code is unreachable. Just remove the test and code block. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/net/ks8851_mll.c | 5 ----- 1 file changed, 5 deletions(-) (limited to 'drivers') diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c index cc2e826257a..2c956154d09 100644 --- a/drivers/net/ks8851_mll.c +++ b/drivers/net/ks8851_mll.c @@ -347,11 +347,6 @@ static int ks8851_mll_detect_chip(struct ks_net *ks) debug("Read back KS8851 id 0x%x\n", val); - if ((val & 0xfff0) != CIDER_ID) { - printf(DRIVERNAME ": Unknown chip ID %04x\n", val); - return -1; - } - return 0; } -- cgit v1.2.3 From 783ea37c7b52ae088e8c64581fbe412b5dc9a878 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 18 Aug 2025 11:44:28 +0100 Subject: phy: cadence: sierra: Remove variable that is not assigned to In cdns_sierra_pll_bind_of_clocks the variable 'i' is declared but never assigned to before its value is used in a dev_err. Replace clk_names[i] by the name passed to device_bind(), i.e., "pll_mux_clk". With that, the clk_names[] array is unused and can therefore be removed. This issue was found by Smatch. Signed-off-by: Andrew Goodbody [jf: update description] Signed-off-by: Jerome Forissier --- drivers/phy/cadence/phy-cadence-sierra.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) (limited to 'drivers') diff --git a/drivers/phy/cadence/phy-cadence-sierra.c b/drivers/phy/cadence/phy-cadence-sierra.c index 2c9d5a12127..bd7ab9d1b77 100644 --- a/drivers/phy/cadence/phy-cadence-sierra.c +++ b/drivers/phy/cadence/phy-cadence-sierra.c @@ -225,11 +225,6 @@ static const struct reg_field pllctrl_lock = static const struct reg_field phy_iso_link_ctrl_1 = REG_FIELD(SIERRA_PHY_ISO_LINK_CTRL, 1, 1); -static const char * const clk_names[] = { - [CDNS_SIERRA_PLL_CMNLC] = "pll_cmnlc", - [CDNS_SIERRA_PLL_CMNLC1] = "pll_cmnlc1", -}; - enum cdns_sierra_cmn_plllc { CMN_PLLLC, CMN_PLLLC1, @@ -602,7 +597,7 @@ static int cdns_sierra_pll_bind_of_clocks(struct cdns_sierra_phy *sp) struct udevice *dev = sp->dev; struct driver *cdns_sierra_clk_drv; struct cdns_sierra_pll_mux_sel *data = pll_clk_mux_sel; - int i, rc; + int rc; cdns_sierra_clk_drv = lists_driver_lookup_name("cdns_sierra_mux_clk"); if (!cdns_sierra_clk_drv) { @@ -612,10 +607,8 @@ static int cdns_sierra_pll_bind_of_clocks(struct cdns_sierra_phy *sp) rc = device_bind(dev, cdns_sierra_clk_drv, "pll_mux_clk", data, dev_ofnode(dev), NULL); - if (rc) { - dev_err(dev, "cannot bind driver for clock %s\n", - clk_names[i]); - } + if (rc) + dev_err(dev, "cannot bind driver for clock pll_mux_clk\n"); return 0; } -- cgit v1.2.3 From c4526c390a3c4ea1c4f244b6436ebbb74902769a Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 18 Aug 2025 11:44:29 +0100 Subject: phy: cadence: torrent: Set an error code for return In cdns_torrent_phy_probe the test for too many lanes configured does not set an error code before taking the error path. This could lead to a silent failure if the calling code does not detect the error. Add the code to return -EINVAL in this case. This issue was found by Smatch. Signed-off-by: Andrew Goodbody --- drivers/phy/cadence/phy-cadence-torrent.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers') diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c index 1f566d082f9..28fe026223c 100644 --- a/drivers/phy/cadence/phy-cadence-torrent.c +++ b/drivers/phy/cadence/phy-cadence-torrent.c @@ -719,6 +719,7 @@ static int cdns_torrent_phy_probe(struct udevice *dev) if (total_num_lanes > MAX_NUM_LANES) { dev_err(dev, "Invalid lane configuration\n"); + ret = -EINVAL; goto put_lnk_rst; } -- cgit v1.2.3