From 0331b1c6111d198195298a2885dbd93cac1ad26a Mon Sep 17 00:00:00 2001 From: Jacky Bai Date: Tue, 8 Sep 2020 09:55:59 +0800 Subject: [PATCH] fix(imx8m): fix coverity out of bound access issue Fix the out of bound access to the rank setting array. Fix Coverity issue: CID 6474575: Out-of-bounds access (OVERRUN) CID 11014855: Unused value (UNUSED_VALUE) Signed-off-by: Jacky Bai Reviewed-by: Ye Li Change-Id: I5d9ef90f1479e5d46d1b6c8693a27e3abd614766 --- plat/imx/imx8m/ddr/dram.c | 14 ++++++++++++-- plat/imx/imx8m/ddr/dram_retention.c | 3 +++ plat/imx/imx8m/include/dram.h | 2 ++ 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/plat/imx/imx8m/ddr/dram.c b/plat/imx/imx8m/ddr/dram.c index 6780bed9c..60185d7aa 100644 --- a/plat/imx/imx8m/ddr/dram.c +++ b/plat/imx/imx8m/ddr/dram.c @@ -49,6 +49,9 @@ static void save_rank_setting(void) uint32_t i, offset; uint32_t pstate_num = dram_info.num_fsp; + /* only support maximum 3 setpoints */ + pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num; + for (i = 0U; i < pstate_num; i++) { offset = i ? (i + 1) * 0x1000 : 0U; dram_info.rank_setting[i][0] = mmio_read_32(DDRC_DRAMTMG2(0) + offset); @@ -168,7 +171,14 @@ void dram_info_init(unsigned long dram_timing_base) } idx = i; } - dram_info.num_fsp = i; + + /* only support maximum 3 setpoints */ + dram_info.num_fsp = (i > MAX_FSP_NUM) ? MAX_FSP_NUM : i; + + /* no valid fsp table, return directly */ + if (i == 0U) { + return; + } /* save the DRAMTMG2/9 for rank to rank workaround */ save_rank_setting(); @@ -256,7 +266,7 @@ int dram_dvfs_handler(uint32_t smc_fid, void *handle, SMC_RET1(handle, dram_info.num_fsp); } else if (x1 == IMX_SIP_DDR_DVFS_GET_FREQ_INFO) { return dram_dvfs_get_freq_info(handle, x2); - } else if (x1 < 4) { + } else if (x1 < 3U) { wait_ddrc_hwffc_done = true; dsb(); diff --git a/plat/imx/imx8m/ddr/dram_retention.c b/plat/imx/imx8m/ddr/dram_retention.c index adcae57b9..7572e8692 100644 --- a/plat/imx/imx8m/ddr/dram_retention.c +++ b/plat/imx/imx8m/ddr/dram_retention.c @@ -32,6 +32,9 @@ static void rank_setting_update(void) uint32_t i, offset; uint32_t pstate_num = dram_info.num_fsp; + /* only support maximum 3 setpoints */ + pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num; + for (i = 0U; i < pstate_num; i++) { offset = i ? (i + 1) * 0x1000 : 0U; mmio_write_32(DDRC_DRAMTMG2(0) + offset, dram_info.rank_setting[i][0]); diff --git a/plat/imx/imx8m/include/dram.h b/plat/imx/imx8m/include/dram.h index db433522b..e8caa21f8 100644 --- a/plat/imx/imx8m/include/dram.h +++ b/plat/imx/imx8m/include/dram.h @@ -23,6 +23,8 @@ #define DDRC_ACTIVE_ONE_RANK U(0x1) #define DDRC_ACTIVE_TWO_RANK U(0x2) +#define MAX_FSP_NUM U(3) + /* reg & config param */ struct dram_cfg_param { unsigned int reg; -- 2.39.5