fix(imx8m): fix coverity out of bound access issue

Fix the out of bound access to the rank setting array.

Fix Coverity issue:

CID 6474575: Out-of-bounds access (OVERRUN)
CID 11014855: Unused value (UNUSED_VALUE)

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Change-Id: I5d9ef90f1479e5d46d1b6c8693a27e3abd614766
diff --git a/plat/imx/imx8m/ddr/dram.c b/plat/imx/imx8m/ddr/dram.c
index 6780bed..60185d7 100644
--- a/plat/imx/imx8m/ddr/dram.c
+++ b/plat/imx/imx8m/ddr/dram.c
@@ -49,6 +49,9 @@
 	uint32_t i, offset;
 	uint32_t pstate_num = dram_info.num_fsp;
 
+	/* only support maximum 3 setpoints */
+	pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num;
+
 	for (i = 0U; i < pstate_num; i++) {
 		offset = i ? (i + 1) * 0x1000 : 0U;
 		dram_info.rank_setting[i][0] = mmio_read_32(DDRC_DRAMTMG2(0) + offset);
@@ -168,7 +171,14 @@
 		}
 		idx = i;
 	}
-	dram_info.num_fsp = i;
+
+	/* only support maximum 3 setpoints */
+	dram_info.num_fsp = (i > MAX_FSP_NUM) ? MAX_FSP_NUM : i;
+
+	/* no valid fsp table, return directly */
+	if (i == 0U) {
+		return;
+	}
 
 	/* save the DRAMTMG2/9 for rank to rank workaround */
 	save_rank_setting();
@@ -256,7 +266,7 @@
 		SMC_RET1(handle, dram_info.num_fsp);
 	} else if (x1 == IMX_SIP_DDR_DVFS_GET_FREQ_INFO) {
 		return dram_dvfs_get_freq_info(handle, x2);
-	} else if (x1 < 4) {
+	} else if (x1 < 3U) {
 		wait_ddrc_hwffc_done = true;
 		dsb();
 
diff --git a/plat/imx/imx8m/ddr/dram_retention.c b/plat/imx/imx8m/ddr/dram_retention.c
index adcae57..7572e86 100644
--- a/plat/imx/imx8m/ddr/dram_retention.c
+++ b/plat/imx/imx8m/ddr/dram_retention.c
@@ -32,6 +32,9 @@
 	uint32_t i, offset;
 	uint32_t pstate_num = dram_info.num_fsp;
 
+	/* only support maximum 3 setpoints */
+	pstate_num = (pstate_num > MAX_FSP_NUM) ? MAX_FSP_NUM : pstate_num;
+
 	for (i = 0U; i < pstate_num; i++) {
 		offset = i ? (i + 1) * 0x1000 : 0U;
 		mmio_write_32(DDRC_DRAMTMG2(0) + offset, dram_info.rank_setting[i][0]);
diff --git a/plat/imx/imx8m/include/dram.h b/plat/imx/imx8m/include/dram.h
index db43352..e8caa21 100644
--- a/plat/imx/imx8m/include/dram.h
+++ b/plat/imx/imx8m/include/dram.h
@@ -23,6 +23,8 @@
 #define DDRC_ACTIVE_ONE_RANK	U(0x1)
 #define DDRC_ACTIVE_TWO_RANK	U(0x2)
 
+#define MAX_FSP_NUM		U(3)
+
 /* reg & config param */
 struct dram_cfg_param {
 	unsigned int reg;