imx: mx7: fix potential overflow in imx_ddr_size()

PATCH RESEND New Marcel Ziswiler 3 participants 6 messages Oct 16, 2018

Subsystems (3)

Arm (32-bit) Arm sub-architectures Arm i.MX and Layerscape

lore

Share & tools

lore

Marcel Ziswiler

author

2018-10-16 06:46 UTC #0 lore raw

PATCH RESEND v2 1/2 imx: mx7: fix potential overflow in imx_ddr_size()

From: Marcel Ziswiler <[email protected]>

The imx_ddr_size() function may overflow as it is possible to kind of over provision the DDR controller. Fix this by capping it to 2 GB which is the maximum allowed size as per reference manual.

Signed-off-by Marcel Ziswiler <[email protected]>

Reviewed-by Fabio Estevam <[email protected]>

---

Changes in v2: None

 arch/arm/mach-imx/mx7/ddr.c | 4 ++++
 1 file changed, 4 insertions(+)

arch/arm/mach-imx/mx7/ddr.c +4 -0

index f19aeb8042..9713835bf2 100644
@@ -196,5 +196,9 @@ unsigned int imx_ddr_size(void)
 	if (field_val <= 29)
 		bits++;
 
+	/* cap to max 2 GB */
+	if (bits > 31)
+		bits = 31;
+
 	return 1 << bits;
 }

Signature · 1 line

2.14.4

Marcel Ziswiler

author

2018-10-16 06:46 UTC #1 lore raw

PATCH RESEND v2 2/2 colibri_imx7: prime get_ram_size() using imx_ddr_size()

From: Fabio Estevam <[email protected]>

Rather than passing a hardcoded maxsize to the generic get_ram_size() function use the i.MX 7 specific imx_ddr_size() function, which extracts the memory size at runtime by reading the DDR controller registers.

This is a purely cosmetic change as the generic get_ram_size() function already took care of properly automatically detecting 256MB, 512MB or 1GB modules.

Signed-off-by Fabio Estevam <[email protected]>

Signed-off-by Marcel Ziswiler <[email protected]>

Reviewed-by Fabio Estevam <[email protected]>

Acked-by Stefan Agner <[email protected]>

---

Changes in v2:
- Added Fabio's and Stefan's acks resp. reviewed-bys.

 board/toradex/colibri_imx7/colibri_imx7.c | 2 +-
 include/configs/colibri_imx7.h            | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

board/toradex/colibri_imx7/colibri_imx7.c +1 -1

index 2b7591eb00..a4c99626b4 100644
@@ -52,7 +52,7 @@ DECLARE_GLOBAL_DATA_PTR;
 
 int dram_init(void)
 {
-	gd->ram_size = get_ram_size((void *)PHYS_SDRAM, PHYS_SDRAM_SIZE);
+	gd->ram_size = get_ram_size((void *)PHYS_SDRAM, imx_ddr_size());
 
 	return 0;
 }

include/configs/colibri_imx7.h +0 -1

index ff6bd678cf..02849ba35f 100644
@@ -14,7 +14,6 @@
 #include "mx7_common.h"
 
 /*#define CONFIG_DBG_MONITOR*/
-#define PHYS_SDRAM_SIZE			SZ_1G
 
 /* Size of malloc() pool */
 #define CONFIG_SYS_MALLOC_LEN		(32 * SZ_1M)

Signature · 1 line

2.14.4

Stefano Babic

2018-10-16 08:06 UTC #2 lore raw

PATCH RESEND v2 1/2 imx: mx7: fix potential overflow in imx_ddr_size()

In reply to Marcel Ziswiler

Hi Marcel,

Quoted 22 lines · Marcel Ziswiler

From: Marcel Ziswiler <[email protected]>
The imx_ddr_size() function may overflow as it is possible to kind of over provision the DDR controller. Fix this by capping it to 2 GB which is the maximum allowed size as per reference manual.
Signed-off-by Marcel Ziswiler <[email protected]>
Reviewed-by Fabio Estevam <[email protected]>
---
Changes in v2: None
 arch/arm/mach-imx/mx7/ddr.c | 4 ++++
 1 file changed, 4 insertions(+)
arch/arm/mach-imx/mx7/ddr.c +0 -0
index f19aeb8042..9713835bf2 100644

arch/arm/mach-imx/mx7/ddr.c unsigned int imx_ddr_size(void) · line 204

Quoted 9 lines

arch/arm/mach-imx/mx7/ddr.c +4 -0

@@ -196,5 +196,9 @@ unsigned int imx_ddr_size(void)
 	if (field_val <= 29)
 		bits++;
 
+	/* cap to max 2 GB */
+	if (bits > 31)
+		bits = 31;
+
 	return 1 << bits;
 }

This is a good catch, thanks for it ! The two patches in V2 (the second for colibri) are already in my list. Does this mean that you want I drop "colibri_imx7: prime get_ram_size() using imx_ddr_size() " ?

Thanks,
Stefano

Signature · 5 lines

=====================================================================
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de
=====================================================================

Marcel Ziswiler

2018-10-16 08:25 UTC #3 lore raw

PATCH RESEND v2 1/2 imx: mx7: fix potential overflow in imx_ddr_size()

Hi Stefano

Quoted 30 lines · Stefano Babic

Hi Marcel,
Quoted 27 lines · Marcel Ziswiler
From: Marcel Ziswiler <[email protected]>
The imx_ddr_size() function may overflow as it is possible to kind of
over provision the DDR controller. Fix this by capping it to 2 GB which
is the maximum allowed size as per reference manual.
Signed-off-by Marcel Ziswiler <[email protected]>
Reviewed-by Fabio Estevam <[email protected]>
---
Changes in v2: None
 arch/arm/mach-imx/mx7/ddr.c | 4 ++++
 1 file changed, 4 insertions(+)
arch/arm/mach- renamed from arch/arm/mach-imx/mx7/ddr.c +0 -0
imx/mx7/ddr.c
index f19aeb8042..9713835bf2 100644
arch/arm/mach-imx/mx7/ddr.c +0 -0
@@ -196,5 +196,9 @@ unsigned int imx_ddr_size(void)
 	if (field_val <= 29)
 		bits++;
 

Quoted 13 lines

arch/arm/mach-imx/mx7/ddr.c unsigned int imx_ddr_size(void) · line 204
Quoted 7 lines
arch/arm/mach-imx/mx7/ddr.c +4 -0
+	/* cap to max 2 GB */
+	if (bits > 31)
+		bits = 31;
+
 	return 1 << bits;
 }
This is a good catch, thanks for it ! The two patches in V2 (the second
for colibri) are already in my list. Does this mean that you want I drop
"colibri_imx7: prime get_ram_size() using imx_ddr_size() " ?

No, no. I just resent both as I did not see any activity on it but if you already have them queued that's completely fine. Thanks!

Quoted 2 lines

Thanks,
Stefano

Cheers

Marcel

Stefano Babic

2018-10-16 08:37 UTC #4 lore raw

PATCH RESEND v2 1/2 imx: mx7: fix potential overflow in imx_ddr_size()

Quoted 47 lines · Marcel Ziswiler

Hi Stefano
Quoted 30 lines · Stefano Babic
Hi Marcel,
Quoted 27 lines · Marcel Ziswiler
From: Marcel Ziswiler <[email protected]>
The imx_ddr_size() function may overflow as it is possible to kind of
over provision the DDR controller. Fix this by capping it to 2 GB which
is the maximum allowed size as per reference manual.
Signed-off-by Marcel Ziswiler <[email protected]>
Reviewed-by Fabio Estevam <[email protected]>
---
Changes in v2: None
 arch/arm/mach-imx/mx7/ddr.c | 4 ++++
 1 file changed, 4 insertions(+)
arch/arm/mach- renamed from arch/arm/mach-imx/mx7/ddr.c +0 -0
imx/mx7/ddr.c
index f19aeb8042..9713835bf2 100644
arch/arm/mach-imx/mx7/ddr.c +0 -0
@@ -196,5 +196,9 @@ unsigned int imx_ddr_size(void)
 	if (field_val <= 29)
 		bits++;
 
Quoted 13 lines
arch/arm/mach-imx/mx7/ddr.c unsigned int imx_ddr_size(void) · line 204
Quoted 7 lines
arch/arm/mach-imx/mx7/ddr.c +4 -0
+	/* cap to max 2 GB */
+	if (bits > 31)
+		bits = 31;
+
 	return 1 << bits;
 }
This is a good catch, thanks for it ! The two patches in V2 (the second
for colibri) are already in my list. Does this mean that you want I drop
"colibri_imx7: prime get_ram_size() using imx_ddr_size() " ?

Quoted 3 lines

No, no. I just resent both as I did not see any activity on it but if you already have them queued that's completely fine. Thanks!

Ah, ok - I had already applied the two patches and you see them on u-boot-imx. However, I have not sent a PR to Tom.

Regards,
Stefano

Signature · 5 lines

=====================================================================
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de
=====================================================================

Marcel Ziswiler

2018-10-16 08:42 UTC #5 lore raw

PATCH RESEND v2 1/2 imx: mx7: fix potential overflow in imx_ddr_size()

Quoted 51 lines · Stefano Babic

Quoted 50 lines · Marcel Ziswiler
Hi Stefano
Quoted 46 lines · Stefano Babic
Hi Marcel,
Quoted 27 lines · Marcel Ziswiler
From: Marcel Ziswiler <[email protected]>
The imx_ddr_size() function may overflow as it is possible to kind
of
over provision the DDR controller. Fix this by capping it to 2 GB
which
is the maximum allowed size as per reference manual.
Signed-off-by Marcel Ziswiler <[email protected]>
Reviewed-by Fabio Estevam <[email protected]>
---
Changes in v2: None
 arch/arm/mach-imx/mx7/ddr.c | 4 ++++
 1 file changed, 4 insertions(+)
arch/arm/mach- renamed from arch/arm/mach-imx/mx7/ddr.c +0 -0
imx/mx7/ddr.c
index f19aeb8042..9713835bf2 100644
arch/arm/mach-imx/mx7/ddr.c unsigned int imx_ddr_size(void) · line 204
Quoted 9 lines
arch/arm/mach-imx/mx7/ddr.c +4 -0
@@ -196,5 +196,9 @@ unsigned int imx_ddr_size(void)
 	if (field_val <= 29)
 		bits++;
 
+	/* cap to max 2 GB */
+	if (bits > 31)
+		bits = 31;
+
 	return 1 << bits;
 }
This is a good catch, thanks for it ! The two patches in V2 (the second
for colibri) are already in my list. Does this mean that you want I
drop
"colibri_imx7: prime get_ram_size() using imx_ddr_size() " ?

Quoted 7 lines

Quoted 4 lines
No, no. I just resent both as I did not see any activity on it but if
you already have them queued that's completely fine. Thanks!
Ah, ok - I had already applied the two patches and you see them on u-boot-imx. However, I have not sent a PR to Tom.

Ah, yeah. Sorry, I forgot to check there. Perfect!

Quoted 2 lines

Regards,
Stefano

Cheers

Marcel