[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 44/97] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_bu
From: |
Michael Roth |
Subject: |
[PATCH 44/97] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[] |
Date: |
Tue, 1 Oct 2019 18:45:23 -0500 |
From: Philippe Mathieu-Daudé <address@hidden>
Both lqspi_read() and lqspi_load_cache() expect a 32-bit
aligned address.
>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':
Transfer Size Limitations
Because of the 32-bit wide TX, RX, and generic FIFO, all
APB/AXI transfers must be an integer multiple of 4-bytes.
Shorter transfers are not possible.
Set MemoryRegionOps.impl values to force 32-bit accesses,
this way we are sure we do not access the lqspi_buf[] array
out of bound.
[*]
https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
Reviewed-by: Francisco Iglesias <address@hidden>
Tested-by: Francisco Iglesias <address@hidden>
Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 526668c734e6a07f2fedfd378840a61b70c1cbab)
Signed-off-by: Michael Roth <address@hidden>
---
hw/ssi/xilinx_spips.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 83ed5ab1e0..b649c464fb 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -1236,6 +1236,10 @@ static const MemoryRegionOps lqspi_ops = {
.read_with_attrs = lqspi_read,
.write_with_attrs = lqspi_write,
.endianness = DEVICE_NATIVE_ENDIAN,
+ .impl = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
.valid = {
.min_access_size = 1,
.max_access_size = 4
--
2.17.1
- [PATCH 29/97] target/ppc: Fix vsum2sws, (continued)
- [PATCH 29/97] target/ppc: Fix vsum2sws, Michael Roth, 2019/10/01
- [PATCH 40/97] sphinx: add qmp_lexer, Michael Roth, 2019/10/01
- [PATCH 39/97] docs/interop/bitmaps.rst: Fix typos, Michael Roth, 2019/10/01
- [PATCH 46/97] i386/acpi: show PCI Express bus on pxb-pcie expanders, Michael Roth, 2019/10/01
- [PATCH 03/97] qcow2: Fix full preallocation with external data file, Michael Roth, 2019/10/01
- [PATCH 32/97] vl: Fix -drive / -blockdev persistent reservation management, Michael Roth, 2019/10/01
- [PATCH 38/97] virtio-balloon: fix QEMU 4.0 config size migration incompatibility, Michael Roth, 2019/10/01
- [PATCH 49/97] virtio-balloon: Simplify deflate with pbp, Michael Roth, 2019/10/01
- [PATCH 42/97] hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs, Michael Roth, 2019/10/01
- [PATCH 45/97] ioapic: kvm: Skip route updates for masked pins, Michael Roth, 2019/10/01
- [PATCH 44/97] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[],
Michael Roth <=
- [PATCH 50/97] virtio-balloon: Better names for offset variables in inflate/deflate code, Michael Roth, 2019/10/01
- [PATCH 35/97] docs: recommend use of md-clear feature on all Intel CPUs, Michael Roth, 2019/10/01
- [PATCH 43/97] hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory, Michael Roth, 2019/10/01
- [PATCH 36/97] virtio-pci: fix missing device properties, Michael Roth, 2019/10/01
- [PATCH 47/97] virtio-balloon: Fix wrong sign extension of PFNs, Michael Roth, 2019/10/01
- [PATCH 26/97] target/ppc: Fix xvabs[sd]p, xvnabs[sd]p, xvneg[sd]p, xvcpsgn[sd]p, Michael Roth, 2019/10/01
- [PATCH 27/97] target/ppc: Fix xvxsigdp, Michael Roth, 2019/10/01
- [PATCH 53/97] virtio-balloon: don't track subpages for the PBP, Michael Roth, 2019/10/01
- [PATCH 48/97] virtio-balloon: Fix QEMU crashes on pagesize > BALLOON_PAGE_SIZE, Michael Roth, 2019/10/01
- [PATCH 51/97] virtio-balloon: Rework pbp tracking data, Michael Roth, 2019/10/01