fix(imx8m): fix coverity out of bound access issue

Fix the out of bound access to the rank setting array.

Fix Coverity issue:

CID 6474575: Out-of-bounds access (OVERRUN)
CID 11014855: Unused value (UNUSED_VALUE)

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Change-Id: I5d9ef90f1479e5d46d1b6c8693a27e3abd614766

diff --git a/plat/imx/imx8m/ddr/dram.c b/plat/imx/imx8m/ddr/dram.c
index 6780bed9c5e697ab5fed6dfb3add64659797ba3a..60185d7aa4bf7e1b91fae01bec2a74796020f108 100644 (file)
--- a/plat/imx/imx8m/ddr/dram.c
+++ b/plat/imx/imx8m/ddr/dram.c
@@ -49,6 +49,9 @@ static void save_rank_setting(void)
        uint32_t i, offset;
        uint32_t pstate_num = dram_info.num_fsp;
 
+       /* only support maximum 3 setpoints */
+       pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num;
+
        for (i = 0U; i < pstate_num; i++) {
                offset = i ? (i + 1) * 0x1000 : 0U;
                dram_info.rank_setting[i][0] = mmio_read_32(DDRC_DRAMTMG2(0) + offset);
@@ -168,7 +171,14 @@ void dram_info_init(unsigned long dram_timing_base)
                }
                idx = i;
        }
-       dram_info.num_fsp = i;
+
+       /* only support maximum 3 setpoints */
+       dram_info.num_fsp = (i > MAX_FSP_NUM) ? MAX_FSP_NUM : i;
+
+       /* no valid fsp table, return directly */
+       if (i == 0U) {
+               return;
+       }
 
        /* save the DRAMTMG2/9 for rank to rank workaround */
        save_rank_setting();
@@ -256,7 +266,7 @@ int dram_dvfs_handler(uint32_t smc_fid, void *handle,
                SMC_RET1(handle, dram_info.num_fsp);
        } else if (x1 == IMX_SIP_DDR_DVFS_GET_FREQ_INFO) {
                return dram_dvfs_get_freq_info(handle, x2);
-       } else if (x1 < 4) {
+       } else if (x1 < 3U) {
                wait_ddrc_hwffc_done = true;
                dsb();
 

diff --git a/plat/imx/imx8m/ddr/dram_retention.c b/plat/imx/imx8m/ddr/dram_retention.c
index adcae57b93dc18fe84741e370a2f0125eef50004..7572e86927b700dd5d2433480fc8d4413e254448 100644 (file)
--- a/plat/imx/imx8m/ddr/dram_retention.c
+++ b/plat/imx/imx8m/ddr/dram_retention.c
@@ -32,6 +32,9 @@ static void rank_setting_update(void)
        uint32_t i, offset;
        uint32_t pstate_num = dram_info.num_fsp;
 
+       /* only support maximum 3 setpoints */
+       pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num;
+
        for (i = 0U; i < pstate_num; i++) {
                offset = i ? (i + 1) * 0x1000 : 0U;
                mmio_write_32(DDRC_DRAMTMG2(0) + offset, dram_info.rank_setting[i][0]);

diff --git a/plat/imx/imx8m/include/dram.h b/plat/imx/imx8m/include/dram.h
index db433522b55b46a4f1fbceee1d2e3aa333ad6947..e8caa21f86b2d03ef7c869598479a2b5918c59bf 100644 (file)
--- a/plat/imx/imx8m/include/dram.h
+++ b/plat/imx/imx8m/include/dram.h
@@ -23,6 +23,8 @@
 #define DDRC_ACTIVE_ONE_RANK   U(0x1)
 #define DDRC_ACTIVE_TWO_RANK   U(0x2)
 
+#define MAX_FSP_NUM            U(3)
+
 /* reg & config param */
 struct dram_cfg_param {
        unsigned int reg;