fix(imx8m): fix coverity out of bound access issue
Fix the out of bound access to the rank setting array.
Fix Coverity issue:
CID 6474575: Out-of-bounds access (OVERRUN)
CID 11014855: Unused value (UNUSED_VALUE)
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Change-Id: I5d9ef90f1479e5d46d1b6c8693a27e3abd614766
diff --git a/plat/imx/imx8m/ddr/dram.c b/plat/imx/imx8m/ddr/dram.c
index 6780bed..60185d7 100644
--- a/plat/imx/imx8m/ddr/dram.c
+++ b/plat/imx/imx8m/ddr/dram.c
@@ -49,6 +49,9 @@
uint32_t i, offset;
uint32_t pstate_num = dram_info.num_fsp;
+ /* only support maximum 3 setpoints */
+ pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num;
+
for (i = 0U; i < pstate_num; i++) {
offset = i ? (i + 1) * 0x1000 : 0U;
dram_info.rank_setting[i][0] = mmio_read_32(DDRC_DRAMTMG2(0) + offset);
@@ -168,7 +171,14 @@
}
idx = i;
}
- dram_info.num_fsp = i;
+
+ /* only support maximum 3 setpoints */
+ dram_info.num_fsp = (i > MAX_FSP_NUM) ? MAX_FSP_NUM : i;
+
+ /* no valid fsp table, return directly */
+ if (i == 0U) {
+ return;
+ }
/* save the DRAMTMG2/9 for rank to rank workaround */
save_rank_setting();
@@ -256,7 +266,7 @@
SMC_RET1(handle, dram_info.num_fsp);
} else if (x1 == IMX_SIP_DDR_DVFS_GET_FREQ_INFO) {
return dram_dvfs_get_freq_info(handle, x2);
- } else if (x1 < 4) {
+ } else if (x1 < 3U) {
wait_ddrc_hwffc_done = true;
dsb();
diff --git a/plat/imx/imx8m/ddr/dram_retention.c b/plat/imx/imx8m/ddr/dram_retention.c
index adcae57..7572e86 100644
--- a/plat/imx/imx8m/ddr/dram_retention.c
+++ b/plat/imx/imx8m/ddr/dram_retention.c
@@ -32,6 +32,9 @@
uint32_t i, offset;
uint32_t pstate_num = dram_info.num_fsp;
+ /* only support maximum 3 setpoints */
+ pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num;
+
for (i = 0U; i < pstate_num; i++) {
offset = i ? (i + 1) * 0x1000 : 0U;
mmio_write_32(DDRC_DRAMTMG2(0) + offset, dram_info.rank_setting[i][0]);
diff --git a/plat/imx/imx8m/include/dram.h b/plat/imx/imx8m/include/dram.h
index db43352..e8caa21 100644
--- a/plat/imx/imx8m/include/dram.h
+++ b/plat/imx/imx8m/include/dram.h
@@ -23,6 +23,8 @@
#define DDRC_ACTIVE_ONE_RANK U(0x1)
#define DDRC_ACTIVE_TWO_RANK U(0x2)
+#define MAX_FSP_NUM U(3)
+
/* reg & config param */
struct dram_cfg_param {
unsigned int reg;