[PATCHv2] firmware: zynqmp: add handling of the NULL return payload pointer in xilinx_pm_request.

[Adrian Fiergolski]

When a caller is not interested in the returned message, the ret_payload pointer is set to NULL in the u-boot-sources.
In this case, under EL3, the memory from address 0x0 would be overwritten by xilinx_pm_request with the returned IPI message,
damaging the original data under this address. The patch, in case ret_payload is NULL, assigns the pointer to the array
holding the IPI message being sent.

Signed-off-by: Adrian Fiergolski <adrian.fiergolski at fastree3d.com>
---
 drivers/firmware/firmware-zynqmp.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/firmware/firmware-zynqmp.c b/drivers/firmware/firmware-zynqmp.c
index d4dc856baf..7517a84f0e 100644
--- a/drivers/firmware/firmware-zynqmp.c
+++ b/drivers/firmware/firmware-zynqmp.c
@@ -154,16 +154,24 @@ U_BOOT_DRIVER(zynqmp_power) = {
 int __maybe_unused xilinx_pm_request(u32 api_id, u32 arg0, u32 arg1, u32 arg2,
 				     u32 arg3, u32 *ret_payload)
 {
+#if defined(CONFIG_ZYNQMP_IPI)
+	/*
+	 * Use fixed payload and arg size as the EL2 call. The firmware
+	 * is capable to handle PMUFW_PAYLOAD_ARG_CNT bytes but the
+	 * firmware API is limited by the SMC call size
+	 */
+	u32 regs[] = {api_id, arg0, arg1, arg2, arg3};
+
+	/*
+	 * Use regs array in case ret_payload is NULL
+	 */
+	if (ret_payload == NULL)
+		ret_payload = regs;
+#endif
 	debug("%s at EL%d, API ID: 0x%0x\n", __func__, current_el(), api_id);
 
 	if (IS_ENABLED(CONFIG_SPL_BUILD) || current_el() == 3) {
 #if defined(CONFIG_ZYNQMP_IPI)
-		/*
-		 * Use fixed payload and arg size as the EL2 call. The firmware
-		 * is capable to handle PMUFW_PAYLOAD_ARG_CNT bytes but the
-		 * firmware API is limited by the SMC call size
-		 */
-		u32 regs[] = {api_id, arg0, arg1, arg2, arg3};
 
 		if (api_id == PM_FPGA_LOAD) {
 			/* Swap addr_hi/low because of incompatibility */
-- 
2.33.0