sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

soc/nvidia/tegra124: Fix null pointer and logic bug

Browse Source 
Commit 680027edf6 fixed a null dereference and logic bug in the tegra210
spi code:

    soc/nvidia/tegra210: Fix potential NULL pointer dereference

    Recent Coverity scan indicated potential NULL deference; if either
    spi->dma_in or spi->dma_out are NULL, the fifo_error() check could
    dereference a NULL pointer.

    Also fixed what appears to be a logic bug for the spi->dma_out case,
    where it was using the todo (count) from spi->dma_in.

Coverity is warning about the same problem for tegra124, so apply the
same fix there. Also, add braces around a while statement.

Change-Id: I6a7403417ee83b703cf4ca495129f73c66691ea9
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 124183, 124185
Reviewed-on: https://review.coreboot.org/c/coreboot/+/35904
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
This commit is contained in:
Jacob Garber 2019-10-08 21:24:27 -06:00 committed by Patrick Georgi
parent 39bde7cacf
commit 61a2d25a01
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/soc/nvidia/tegra124/spi.c
View File

@ -288,6 +288,9 @@ static void dump_spi_regs(struct tegra_spi_channel *spi)
static void dump_dma_regs(struct apb_dma_channel *dma) static void dump_dma_regs(struct apb_dma_channel *dma)
{ {
if (dma == NULL)
return;
printk(BIOS_INFO, "DMA regs:\n" printk(BIOS_INFO, "DMA regs:\n"
"\tahb_ptr: 0x%08x\n" "\tahb_ptr: 0x%08x\n"
"\tapb_ptr: 0x%08x\n" "\tapb_ptr: 0x%08x\n"
@ -545,9 +548,9 @@ static int tegra_spi_dma_finish(struct tegra_spi_channel *spi)
int ret; int ret;
unsigned int todo; unsigned int todo;
if (spi->dma_in) {
todo = read32(&spi->dma_in->regs->wcount); todo = read32(&spi->dma_in->regs->wcount);
if (spi->dma_in) {
while ((read32(&spi->dma_in->regs->dma_byte_sta) < todo) || while ((read32(&spi->dma_in->regs->dma_byte_sta) < todo) ||
dma_busy(spi->dma_in)) dma_busy(spi->dma_in))
; /* this shouldn't take long, no udelay */ ; /* this shouldn't take long, no udelay */
@ -557,9 +560,12 @@ static int tegra_spi_dma_finish(struct tegra_spi_channel *spi)
} }
if (spi->dma_out) { if (spi->dma_out) {
todo = read32(&spi->dma_out->regs->wcount);
while ((read32(&spi->dma_out->regs->dma_byte_sta) < todo) || while ((read32(&spi->dma_out->regs->dma_byte_sta) < todo) ||
dma_busy(spi->dma_out)) dma_busy(spi->dma_out)) {
spi_delay(spi, todo - spi_byte_count(spi)); spi_delay(spi, todo - spi_byte_count(spi));
}
clrbits_le32(&spi->regs->command1, SPI_CMD1_TX_EN); clrbits_le32(&spi->regs->command1, SPI_CMD1_TX_EN);
dma_stop(spi->dma_out); dma_stop(spi->dma_out);
dma_release(spi->dma_out); dma_release(spi->dma_out);