New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware - TF-A

11 Jul 2022


      Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
4 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 4 of 4 defect(s)
** CID 379252:  Concurrent data access violations  (MISSING_LOCK)
/plat/imx/imx8m/ddr/dram.c: 254 in dram_dvfs_handler()
________________________________________________________________________________________________________
*** CID 379252:  Concurrent data access violations  (MISSING_LOCK)
/plat/imx/imx8m/ddr/dram.c: 254 in dram_dvfs_handler()
248     		} else if (dram_info.dram_type == DDRC_DDR4) {
249     			ddr4_swffc(&dram_info, fsp_index);
250     		}
251     
252     		dram_info.current_fsp = fsp_index;
253     		wait_ddrc_hwffc_done = false;
...
...
...
CID 379252:  Concurrent data access violations  (MISSING_LOCK)
Accessing "wfe_done" without holding lock "dfs_lock". Elsewhere, "wfe_done" is accessed with "dfs_lock" held 1 out of 2 times (1 of these accesses strongly imply that it is necessary).

254     		wfe_done = 0;
255     		dsb();
256     		sev();
257     		isb();
258     	}
259     
260     	SMC_RET1(handle, 0);
** CID 379251:  Memory - corruptions  (OVERRUN)
________________________________________________________________________________________________________
*** CID 379251:  Memory - corruptions  (OVERRUN)
/plat/imx/imx8m/ddr/dram.c: 246 in dram_dvfs_handler()
240     		}
241     
242     		/* flush the L1/L2 cache */
243     		dcsw_op_all(DCCSW);
244     
245     		if (dram_info.dram_type == DDRC_LPDDR4) {
...
...
...
CID 379251:  Memory - corruptions  (OVERRUN)
Overrunning callee's array of size 3 by passing argument "fsp_index" (which evaluates to 3) in call to "lpddr4_swffc".

246     			lpddr4_swffc(&dram_info, dev_fsp, fsp_index);
247     			dev_fsp = (~dev_fsp) & 0x1;
248     		} else if (dram_info.dram_type == DDRC_DDR4) {
249     			ddr4_swffc(&dram_info, fsp_index);
250     		}
251
** CID 379250:    (COPY_PASTE_ERROR)
/plat/imx/imx8m/imx8mm/gpc.c: 182 in imx_gpc_pm_domain_enable()
/plat/imx/imx8m/imx8mn/gpc.c: 81 in imx_gpc_pm_domain_enable()
________________________________________________________________________________________________________
*** CID 379250:    (COPY_PASTE_ERROR)
/plat/imx/imx8m/imx8mm/gpc.c: 182 in imx_gpc_pm_domain_enable()
176     		/* HSIOMIX has no PU bit, so skip for it */
177     		if (domain_id != HSIOMIX) {
178     			/* clear the PGC bit */
179     			mmio_clrbits_32(IMX_GPC_BASE + pwr_domain->pgc_offset, 0x1);
180     
181     			/* power up the domain */
...
...
...
CID 379250:    (COPY_PASTE_ERROR)
"mmio_setbits_32" in "mmio_setbits_32(809107704UL, pwr_domain->pwr_req)" looks like a copy-paste error.

182     			mmio_setbits_32(IMX_GPC_BASE + PU_PGC_UP_TRG, pwr_domain->pwr_req);
183     
184     			/* wait for power request done */
185     			while (mmio_read_32(IMX_GPC_BASE + PU_PGC_UP_TRG) & pwr_domain->pwr_req) {
186     				;
187     			}
/plat/imx/imx8m/imx8mn/gpc.c: 81 in imx_gpc_pm_domain_enable()
75     		/* HSIOMIX has no PU bit, so skip for it */
76     		if (domain_id != HSIOMIX) {
77     			/* clear the PGC bit */
78     			mmio_clrbits_32(IMX_GPC_BASE + pwr_domain->pgc_offset, 0x1);
79     
80     			/* power up the domain */
...
...
...
CID 379250:    (COPY_PASTE_ERROR)
"mmio_setbits_32" in "mmio_setbits_32(809107704UL, pwr_domain->pwr_req)" looks like a copy-paste error.

81     			mmio_setbits_32(IMX_GPC_BASE + PU_PGC_UP_TRG, pwr_domain->pwr_req);
82     
83     			/* wait for power request done */
84     			while (mmio_read_32(IMX_GPC_BASE + PU_PGC_UP_TRG) & pwr_domain->pwr_req) {
85     				;
86     			}
** CID 379249:  Memory - illegal accesses  (OVERRUN)
/plat/imx/imx8m/ddr/dram.c: 151 in dram_info_init()
________________________________________________________________________________________________________
*** CID 379249:  Memory - illegal accesses  (OVERRUN)
/plat/imx/imx8m/ddr/dram.c: 151 in dram_info_init()
145     			break;
146     		}
147     	}
148     	dram_info.num_fsp = i;
149     
150     	/* check if has bypass mode support */
...
...
...
CID 379249:  Memory - illegal accesses  (OVERRUN)
Overrunning array "dram_info.timing_info->fsp_table" of 4 4-byte elements at element index 4294967295 (byte offset 17179869183) using index "i - 1U" (which evaluates to 4294967295).

151     	if (dram_info.timing_info->fsp_table[i-1] < 666) {
152     		dram_info.bypass_mode = true;
153     	} else {
154     		dram_info.bypass_mode = false;
155     	}
156
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0...