[bug report] phy: apple: Add Apple Type-C PHY

[bug report] phy: apple: Add Apple Type-C PHY

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Sven Peter,

Commit 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY") from Dec 14,
2025 (linux-next), leads to the following Smatch static checker
warning:

	drivers/phy/apple/atc.c:2209 atcphy_map_resources()
	warn: 'resources[i]->addr' isn't an ERR_PTR

drivers/phy/apple/atc.c
    2191 static int atcphy_map_resources(struct platform_device *pdev, struct apple_atcphy *atcphy)
    2192 {
    2193         struct {
    2194                 const char *name;
    2195                 void __iomem **addr;
    2196                 struct resource **res;
    2197         } resources[] = {
    2198                 { "core", &atcphy->regs.core, &atcphy->res.core },
    2199                 { "lpdptx", &atcphy->regs.lpdptx, NULL },
    2200                 { "axi2af", &atcphy->regs.axi2af, &atcphy->res.axi2af },
    2201                 { "usb2phy", &atcphy->regs.usb2phy, NULL },
    2202                 { "pipehandler", &atcphy->regs.pipehandler, NULL },
    2203         };
    2204         struct resource *res;
    2205 
    2206         for (int i = 0; i < ARRAY_SIZE(resources); i++) {
    2207                 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, resources[i].name);
    2208                 *resources[i].addr = devm_ioremap_resource(&pdev->dev, res);
--> 2209                 if (IS_ERR(resources[i].addr))

This is checking the wrong variable.  The * is missing.
if (IS_ERR(*resources[i].addr)) {

    2210                         return dev_err_probe(atcphy->dev, PTR_ERR(resources[i].addr),
    2211                                              "Unable to map %s regs", resources[i].name);
    2212 
    2213                 if (resources[i].res)
    2214                         *resources[i].res = res;
    2215         }
    2216 
    2217         return 0;
    2218 }

regards,
dan carpenter

[bug report] spi: stm32: properly fail on dma_request_chan error

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Alain Volmat,

Commit c266d19b7d4e ("spi: stm32: properly fail on dma_request_chan
error") from Dec 18, 2025 (linux-next), leads to the following Smatch
static checker warning:

	drivers/spi/spi-stm32.c:2578 stm32_spi_probe()
	error: 'spi->dma_rx' dereferencing possible ERR_PTR()

drivers/spi/spi-stm32.c
    2480         if (STM32_SPI_DEVICE_MODE(spi))
    2481                 ctrl->target_abort = stm32h7_spi_device_abort;
    2482 
    2483         spi->dma_tx = dma_request_chan(spi->dev, "tx");
    2484         if (IS_ERR(spi->dma_tx)) {
    2485                 ret = PTR_ERR(spi->dma_tx);
    2486                 if (ret == -ENODEV) {
    2487                         dev_info(&pdev->dev, "tx dma disabled\n");
    2488                         spi->dma_tx = NULL;
    2489                 } else {
    2490                         dev_err_probe(&pdev->dev, ret, "failed to request tx dma channel\n");
    2491                         goto err_clk_disable;
    2492                 }
    2493         } else {
    2494                 ctrl->dma_tx = spi->dma_tx;
    2495         }
    2496 
    2497         spi->dma_rx = dma_request_chan(spi->dev, "rx");
    2498         if (IS_ERR(spi->dma_rx)) {
    2499                 ret = PTR_ERR(spi->dma_rx);
    2500                 if (ret == -ENODEV) {
    2501                         dev_info(&pdev->dev, "rx dma disabled\n");
    2502                         spi->dma_rx = NULL;
    2503                 } else {
    2504                         dev_err_probe(&pdev->dev, ret, "failed to request rx dma channel\n");
    2505                         goto err_dma_release;

spi->dma_rx is an erorr pointer at this goto so it will crash.

    2506                 }
    2507         } else {
    2508                 ctrl->dma_rx = spi->dma_rx;
    2509         }
    2510 
    2511         if (spi->dma_tx || spi->dma_rx)
    2512                 ctrl->can_dma = stm32_spi_can_dma;
    2513 
    2514         spi->sram_pool = of_gen_pool_get(pdev->dev.of_node, "sram", 0);
    2515         if (spi->sram_pool) {
    2516                 spi->sram_rx_buf_size = gen_pool_size(spi->sram_pool);
    2517                 dev_info(&pdev->dev, "SRAM pool: %zu KiB for RX DMA/MDMA chaining\n",
    2518                          spi->sram_rx_buf_size / 1024);
    2519                 spi->sram_rx_buf = gen_pool_dma_zalloc(spi->sram_pool, spi->sram_rx_buf_size,
    2520                                                        &spi->sram_dma_rx_buf);
    2521                 if (!spi->sram_rx_buf) {
    2522                         dev_err(&pdev->dev, "failed to allocate SRAM buffer\n");
    2523                 } else {
    2524                         spi->mdma_rx = dma_request_chan(spi->dev, "rxm2m");
    2525                         if (IS_ERR(spi->mdma_rx)) {
    2526                                 ret = PTR_ERR(spi->mdma_rx);
    2527                                 spi->mdma_rx = NULL;
    2528                                 if (ret == -EPROBE_DEFER) {
    2529                                         goto err_pool_free;
    2530                                 } else {
    2531                                         gen_pool_free(spi->sram_pool,
    2532                                                       (unsigned long)spi->sram_rx_buf,
    2533                                                       spi->sram_rx_buf_size);
    2534                                         dev_warn(&pdev->dev,
    2535                                                  "failed to request rx mdma channel, DMA only\n");
    2536                                 }
    2537                         }
    2538                 }
    2539         }
    2540 
    2541         pm_runtime_set_autosuspend_delay(&pdev->dev,
    2542                                          STM32_SPI_AUTOSUSPEND_DELAY);
    2543         pm_runtime_use_autosuspend(&pdev->dev);
    2544         pm_runtime_set_active(&pdev->dev);
    2545         pm_runtime_get_noresume(&pdev->dev);
    2546         pm_runtime_enable(&pdev->dev);
    2547 
    2548         ret = spi_register_controller(ctrl);
    2549         if (ret) {
    2550                 dev_err(&pdev->dev, "spi controller registration failed: %d\n",
    2551                         ret);
    2552                 goto err_pm_disable;
    2553         }
    2554 
    2555         pm_runtime_put_autosuspend(&pdev->dev);
    2556 
    2557         dev_info(&pdev->dev, "driver initialized (%s mode)\n",
    2558                  STM32_SPI_HOST_MODE(spi) ? "host" : "device");
    2559 
    2560         return 0;
    2561 
    2562 err_pm_disable:
    2563         pm_runtime_disable(&pdev->dev);
    2564         pm_runtime_put_noidle(&pdev->dev);
    2565         pm_runtime_set_suspended(&pdev->dev);
    2566         pm_runtime_dont_use_autosuspend(&pdev->dev);
    2567 
    2568         if (spi->mdma_rx)
    2569                 dma_release_channel(spi->mdma_rx);
    2570 err_pool_free:
    2571         if (spi->sram_pool)
    2572                 gen_pool_free(spi->sram_pool, (unsigned long)spi->sram_rx_buf,
    2573                               spi->sram_rx_buf_size);
    2574 err_dma_release:
    2575         if (spi->dma_tx)
    2576                 dma_release_channel(spi->dma_tx);
    2577         if (spi->dma_rx)
--> 2578                 dma_release_channel(spi->dma_rx);
                                             ^^^^^^^^^^^
Here.

    2579 err_clk_disable:
    2580         clk_disable_unprepare(spi->clk);
    2581 
    2582         return ret;
    2583 }

regards,
dan carpenter

[bug report] remoteproc: imx_rproc: Introduce prepare ops for imx_rproc_dcfg

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Peng Fan,

Commit edd2a9956055 ("remoteproc: imx_rproc: Introduce prepare ops
for imx_rproc_dcfg") from Jan 9, 2026 (linux-next), leads to the
following Smatch static checker warning:

	drivers/remoteproc/imx_rproc.c:648 imx_rproc_prepare()
	warn: ignoring unreachable code.

drivers/remoteproc/imx_rproc.c
    605 static int imx_rproc_prepare(struct rproc *rproc)
    606 {
    607         struct imx_rproc *priv = rproc->priv;
    608         struct device_node *np = priv->dev->of_node;
    609         struct rproc_mem_entry *mem;
    610         int i = 0;
    611         u32 da;
    612 
    613         /* Register associated reserved memory regions */
    614         while (1) {
    615                 int err;
    616                 struct resource res;
    617 
    618                 err = of_reserved_mem_region_to_resource(np, i++, &res);
    619                 if (err)
    620                         return 0;
    621 
    622                 /*
    623                  * Ignore the first memory region which will be used vdev buffer.
    624                  * No need to do extra handlings, rproc_add_virtio_dev will handle it.
    625                  */
    626                 if (strstarts(res.name, "vdev0buffer"))
    627                         continue;
    628 
    629                 if (strstarts(res.name, "rsc-table"))
    630                         continue;
    631 
    632                 /* No need to translate pa to da, i.MX use same map */
    633                 da = res.start;
    634 
    635                 /* Register memory region */
    636                 mem = rproc_mem_entry_init(priv->dev, NULL, (dma_addr_t)res.start,
    637                                            resource_size(&res), da,
    638                                            imx_rproc_mem_alloc, imx_rproc_mem_release,
    639                                            "%.*s", strchrnul(res.name, '@') - res.name,
    640                                            res.name);
    641                 if (!mem)
    642                         return -ENOMEM;
    643 
    644                 rproc_coredump_add_segment(rproc, da, resource_size(&res));
    645                 rproc_add_carveout(rproc, mem);
    646         }
    647 
--> 648         if (priv->ops && priv->ops->prepare)
    649                 return priv->ops->prepare(rproc);

This is unreachable code.

    650 
    651         return 0;
    652 }

regards,
dan carpenter

[bug report] soc: rockchip: grf: Support multiple grf to be handled

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Shawn Lin,

Commit 75fb63ae0312 ("soc: rockchip: grf: Support multiple grf to be
handled") from Jan 16, 2026 (linux-next), leads to the following
Smatch static checker warning:

	drivers/soc/rockchip/grf.c:249 rockchip_grf_init()
	warn: inconsistent refcounting 'np->kobj.kref.refcount.refs.counter':

drivers/soc/rockchip/grf.c
   212  static int __init rockchip_grf_init(void)
   213  {
   214          const struct rockchip_grf_info *grf_info;
   215          const struct of_device_id *match;
   216          struct device_node *np;
   217          struct regmap *grf;
   218          int ret, i;
   219  
   220          for_each_matching_node_and_match(np, rockchip_grf_dt_match, &match) {
   221                  if (!of_device_is_available(np))
   222                          continue;
   223                  if (!match || !match->data) {
   224                          pr_err("%s: missing grf data\n", __func__);
   225                          of_node_put(np);
   226                          return -EINVAL;
   227                  }
   228  
   229                  grf_info = match->data;
   230  
   231                  grf = syscon_node_to_regmap(np);
   232                  if (IS_ERR(grf)) {
   233                          pr_err("%s: could not get grf syscon\n", __func__);
   234                          return PTR_ERR(grf);

Missing of_node_put(np) before returning.

   235                  }
   236  
   237                  for (i = 0; i < grf_info->num_values; i++) {
   238                          const struct rockchip_grf_value *val = &grf_info->values[i];
   239  
   240                          pr_debug("%s: adjusting %s in %#6x to %#10x\n", __func__,
   241                                  val->desc, val->reg, val->val);
   242                          ret = regmap_write(grf, val->reg, val->val);
   243                          if (ret < 0)
   244                                  pr_err("%s: write to %#6x failed with %d\n",
   245                                          __func__, val->reg, ret);
   246                  }
   247          }
   248  
   249          return 0;
   250  }

regards,
dan carpenter

Re: [bug report] remoteproc: imx_rproc: Introduce prepare ops for imx_rproc_dcfg

[Mathieu Poirier]

On Fri, Feb 06, 2026 at 04:41:13PM +0300, Dan Carpenter wrote:
> [ Smatch checking is paused while we raise funding.  #SadFace
>   https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]
> 
> Hello Peng Fan,
> 
> Commit edd2a9956055 ("remoteproc: imx_rproc: Introduce prepare ops
> for imx_rproc_dcfg") from Jan 9, 2026 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	drivers/remoteproc/imx_rproc.c:648 imx_rproc_prepare()
> 	warn: ignoring unreachable code.
> 
> drivers/remoteproc/imx_rproc.c
>     605 static int imx_rproc_prepare(struct rproc *rproc)
>     606 {
>     607         struct imx_rproc *priv = rproc->priv;
>     608         struct device_node *np = priv->dev->of_node;
>     609         struct rproc_mem_entry *mem;
>     610         int i = 0;
>     611         u32 da;
>     612 
>     613         /* Register associated reserved memory regions */
>     614         while (1) {
>     615                 int err;
>     616                 struct resource res;
>     617 
>     618                 err = of_reserved_mem_region_to_resource(np, i++, &res);
>     619                 if (err)
>     620                         return 0;
>     621 
>     622                 /*
>     623                  * Ignore the first memory region which will be used vdev buffer.
>     624                  * No need to do extra handlings, rproc_add_virtio_dev will handle it.
>     625                  */
>     626                 if (strstarts(res.name, "vdev0buffer"))
>     627                         continue;
>     628 
>     629                 if (strstarts(res.name, "rsc-table"))
>     630                         continue;
>     631 
>     632                 /* No need to translate pa to da, i.MX use same map */
>     633                 da = res.start;
>     634 
>     635                 /* Register memory region */
>     636                 mem = rproc_mem_entry_init(priv->dev, NULL, (dma_addr_t)res.start,
>     637                                            resource_size(&res), da,
>     638                                            imx_rproc_mem_alloc, imx_rproc_mem_release,
>     639                                            "%.*s", strchrnul(res.name, '@') - res.name,
>     640                                            res.name);
>     641                 if (!mem)
>     642                         return -ENOMEM;
>     643 
>     644                 rproc_coredump_add_segment(rproc, da, resource_size(&res));
>     645                 rproc_add_carveout(rproc, mem);
>     646         }
>     647 
> --> 648         if (priv->ops && priv->ops->prepare)
>     649                 return priv->ops->prepare(rproc);
> 
> This is unreachable code.

It looks like Dan (and Smatch) has a point.

> 
>     650 
>     651         return 0;
>     652 }
> 
> regards,
> dan carpenter
> 

Re: [bug report] phy: apple: Add Apple Type-C PHY

[Janne Grunau]

On Fri, Feb 06, 2026 at 04:40:47PM +0300, Dan Carpenter wrote:
> [ Smatch checking is paused while we raise funding.  #SadFace
>   https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

This is unfortunate, there have been useful bug reports.

> Commit 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY") from Dec 14,
> 2025 (linux-next), leads to the following Smatch static checker
> warning:
> 
> 	drivers/phy/apple/atc.c:2209 atcphy_map_resources()
> 	warn: 'resources[i]->addr' isn't an ERR_PTR
> 
> drivers/phy/apple/atc.c
>     2191 static int atcphy_map_resources(struct platform_device *pdev, struct apple_atcphy *atcphy)
>     2192 {
>     2193         struct {
>     2194                 const char *name;
>     2195                 void __iomem **addr;
>     2196                 struct resource **res;
>     2197         } resources[] = {
>     2198                 { "core", &atcphy->regs.core, &atcphy->res.core },
>     2199                 { "lpdptx", &atcphy->regs.lpdptx, NULL },
>     2200                 { "axi2af", &atcphy->regs.axi2af, &atcphy->res.axi2af },
>     2201                 { "usb2phy", &atcphy->regs.usb2phy, NULL },
>     2202                 { "pipehandler", &atcphy->regs.pipehandler, NULL },
>     2203         };
>     2204         struct resource *res;
>     2205 
>     2206         for (int i = 0; i < ARRAY_SIZE(resources); i++) {
>     2207                 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, resources[i].name);
>     2208                 *resources[i].addr = devm_ioremap_resource(&pdev->dev, res);
> --> 2209                 if (IS_ERR(resources[i].addr))
> 
> This is checking the wrong variable.  The * is missing.
> if (IS_ERR(*resources[i].addr)) {

This issue was identified by testing and is fixed in next by commit
7d55b44e2be1 ("phy: apple: atc: Actually check return value of
devm_apple_tunable_parse").

https://lore.kernel.org/all/20260104-atcphy-tunable-fix-v2-1-84e5c2a57aaa@kernel.org/

Thanks for the report

Janne

Re: [bug report] phy: apple: Add Apple Type-C PHY

[Sven Peter]

On 06.02.26 22:47, Janne Grunau wrote:
> On Fri, Feb 06, 2026 at 04:40:47PM +0300, Dan Carpenter wrote:
>> [ Smatch checking is paused while we raise funding.  #SadFace
>>    https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]
> 
> This is unfortunate, there have been useful bug reports.
> 
>> Commit 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY") from Dec 14,
>> 2025 (linux-next), leads to the following Smatch static checker
>> warning:
>>
>> 	drivers/phy/apple/atc.c:2209 atcphy_map_resources()
>> 	warn: 'resources[i]->addr' isn't an ERR_PTR
>>
>> drivers/phy/apple/atc.c
>>      2191 static int atcphy_map_resources(struct platform_device *pdev, struct apple_atcphy *atcphy)
>>      2192 {
>>      2193         struct {
>>      2194                 const char *name;
>>      2195                 void __iomem **addr;
>>      2196                 struct resource **res;
>>      2197         } resources[] = {
>>      2198                 { "core", &atcphy->regs.core, &atcphy->res.core },
>>      2199                 { "lpdptx", &atcphy->regs.lpdptx, NULL },
>>      2200                 { "axi2af", &atcphy->regs.axi2af, &atcphy->res.axi2af },
>>      2201                 { "usb2phy", &atcphy->regs.usb2phy, NULL },
>>      2202                 { "pipehandler", &atcphy->regs.pipehandler, NULL },
>>      2203         };
>>      2204         struct resource *res;
>>      2205
>>      2206         for (int i = 0; i < ARRAY_SIZE(resources); i++) {
>>      2207                 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, resources[i].name);
>>      2208                 *resources[i].addr = devm_ioremap_resource(&pdev->dev, res);
>> --> 2209                 if (IS_ERR(resources[i].addr))
>>
>> This is checking the wrong variable.  The * is missing.
>> if (IS_ERR(*resources[i].addr)) {
> 
> This issue was identified by testing and is fixed in next by commit
> 7d55b44e2be1 ("phy: apple: atc: Actually check return value of
> devm_apple_tunable_parse").
> 
> https://lore.kernel.org/all/20260104-atcphy-tunable-fix-v2-1-84e5c2a57aaa@kernel.org/

I think I actually messed this up *twice*! Once for the tunables and 
once again for the resources here :(


Sven

RE: [bug report] remoteproc: imx_rproc: Introduce prepare ops for imx_rproc_dcfg

[Peng Fan]

Hi Dan,

Thanks for your report.

> Subject: [bug report] remoteproc: imx_rproc: Introduce prepare ops for
> imx_rproc_dcfg
> 
> Hello Peng Fan,
> 
> Commit edd2a9956055 ("remoteproc: imx_rproc: Introduce prepare
> ops for imx_rproc_dcfg") from Jan 9, 2026 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	drivers/remoteproc/imx_rproc.c:648 imx_rproc_prepare()
> 	warn: ignoring unreachable code.
> 
> drivers/remoteproc/imx_rproc.c

[...]
>     642                         return -ENOMEM;
>     643
>     644                 rproc_coredump_add_segment(rproc, da,
> resource_size(&res));
>     645                 rproc_add_carveout(rproc, mem);
>     646         }
>     647
> --> 648         if (priv->ops && priv->ops->prepare)
>     649                 return priv->ops->prepare(rproc);
> 
> This is unreachable code.

Indeed.

The i.MX95 patches were developed quite some time ago. Later, there was
another change [1] which modified the reserved-memory while-loop logic.
When rebasing my changes on top of that, I overlooked this behavior
change, which resulted in the early return making the prepare callback
unreachable.

Regarding why this was not exposed earlier during testing: NXP U-Boot
powers up the M7 (leaving it in reset) and initializes TCM ECC by default.
As a result, even without calling the platform prepare ops, Linux can
still load the M7 ELF correctly, so no issue was observed.

In hindsight, I should have tested the case where M7 remains powered off
when rebasing these changes (:

I have just sent out a fix to address this issue. Thanks again for
reporting it.

[1] 67a7bc7f0358b ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region")

Thanks,
Peng

>     650
>     651         return 0;
>     652 }
> 
> regards,
> dan carpenter