Re: [PATCH v4 7/9] bus: mhi: Capture DDR training data using command mode

[kernel test robot <lkp@intel.com>]

Hi Kishore,

kernel test robot noticed the following build warnings:

[auto build test WARNING on a0ae2a256046c0c5d3778d1a194ff2e171f16e5f]

url:    https://github.com/intel-lab-lkp/linux/commits/Kishore-Batta/Add-documentation-for-Sahara-protocol/20260320-144614
base:   a0ae2a256046c0c5d3778d1a194ff2e171f16e5f
patch link:    https://lore.kernel.org/r/20260319-sahara_protocol_new_v2-v4-7-47ad79308762%40oss.qualcomm.com
patch subject: [PATCH v4 7/9] bus: mhi: Capture DDR training data using command mode
config: i386-randconfig-141-20260322 (https://download.01.org/0day-ci/archive/20260323/202603230107.6EzMoVPn-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9004-gb810ac53

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603230107.6EzMoVPn-lkp@intel.com/

New smatch warnings:
drivers/bus/mhi/sahara/sahara.c:639 sahara_command_execute_resp() warn: unsigned '(context->rx->command_execute_resp.response_length)' is never less than zero.

Old smatch warnings:
drivers/bus/mhi/sahara/sahara.c:353 sahara_select_variant() warn: this array is probably non-NULL. 'id->chan'

vim +639 drivers/bus/mhi/sahara/sahara.c

   628	
   629	static void sahara_command_execute_resp(struct sahara_context *context)
   630	{
   631		struct device *dev = &context->mhi_dev->mhi_cntrl->mhi_dev->dev;
   632		struct sahara_ctrl_trng_data *ct;
   633		u32 client_cmd, resp_len;
   634		int ret;
   635		u64 remaining;
   636		u32 i;
   637	
   638		if (le32_to_cpu(context->rx->length) != SAHARA_COMMAND_EXEC_RESP_LENGTH ||
 > 639		    le32_to_cpu(context->rx->command_execute_resp.response_length) < 0) {
   640			dev_err(&context->mhi_dev->dev,
   641				"Malformed command execute resp packet - length %d\n",
   642				le32_to_cpu(context->rx->length));
   643			return;
   644		}
   645	
   646		client_cmd = le32_to_cpu(context->rx->command_execute_resp.client_command);
   647		resp_len = le32_to_cpu(context->rx->command_execute_resp.response_length);
   648	
   649		sahara_command_execute_data(context, client_cmd);
   650	
   651		if (client_cmd == SAHARA_EXEC_CMD_GET_COMMAND_ID_LIST) {
   652			sahara_command_execute(context, SAHARA_EXEC_CMD_GET_TRAINING_DATA);
   653			return;
   654		}
   655	
   656		if (client_cmd != SAHARA_EXEC_CMD_GET_TRAINING_DATA)
   657			return;
   658	
   659		ct = sahara_ctrl_trng_get(dev);
   660		if (!ct) {
   661			context->is_cmd_mode = false;
   662			sahara_switch_mode_to_img_tx(context);
   663			return;
   664		}
   665	
   666		mutex_lock(&ct->lock);
   667		kfree(ct->data);
   668		ct->data = kzalloc(resp_len, GFP_KERNEL);
   669		ct->size = resp_len;
   670		ct->copied = 0;
   671		ct->receiving = true;
   672		mutex_unlock(&ct->lock);
   673	
   674		if (!ct->data) {
   675			context->is_cmd_mode = false;
   676			sahara_switch_mode_to_img_tx(context);
   677			return;
   678		}
   679	
   680		context->trng_size = resp_len;
   681		context->trng_rcvd = 0;
   682		context->receiving_trng_data = true;
   683	
   684		remaining = resp_len;
   685		for (i = 0; i < SAHARA_NUM_CMD_BUF && remaining; i++) {
   686			size_t pkt = min_t(size_t, remaining, SAHARA_PACKET_MAX_SIZE);
   687	
   688			ret = mhi_queue_buf(context->mhi_dev, DMA_FROM_DEVICE,
   689					    context->cmd_buff[i], pkt,
   690					    (remaining <= pkt) ? MHI_EOT : MHI_CHAIN);
   691			if (ret)
   692				break;
   693	
   694			remaining -= pkt;
   695		}
   696	
   697		context->trng_nbuf = i;
   698	}
   699	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki