diff options
| author | Philippe Mathieu-Daudé <philmd@redhat.com> | 2019-07-15 14:17:03 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2019-07-15 14:17:03 +0100 |
| commit | 526668c734e6a07f2fedfd378840a61b70c1cbab (patch) | |
| tree | 705d632e1901ec42eaf84d7f12be26f46ec15996 /hw/ssi | |
| parent | 936a236c4e4b1068ade99220260cd04f68eb0212 (diff) | |
| download | qemu-526668c734e6a07f2fedfd378840a61b70c1cbab.zip qemu-526668c734e6a07f2fedfd378840a61b70c1cbab.tar.gz qemu-526668c734e6a07f2fedfd378840a61b70c1cbab.tar.bz2 | |
hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
Both lqspi_read() and lqspi_load_cache() expect a 32-bit
aligned address.
>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':
Transfer Size Limitations
Because of the 32-bit wide TX, RX, and generic FIFO, all
APB/AXI transfers must be an integer multiple of 4-bytes.
Shorter transfers are not possible.
Set MemoryRegionOps.impl values to force 32-bit accesses,
this way we are sure we do not access the lqspi_buf[] array
out of bound.
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/ssi')
| -rw-r--r-- | hw/ssi/xilinx_spips.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c index 3c4e836..b29e0a4 100644 --- a/hw/ssi/xilinx_spips.c +++ b/hw/ssi/xilinx_spips.c @@ -1239,6 +1239,10 @@ static const MemoryRegionOps lqspi_ops = { .read_with_attrs = lqspi_read, .write_with_attrs = lqspi_write, .endianness = DEVICE_NATIVE_ENDIAN, + .impl = { + .min_access_size = 4, + .max_access_size = 4, + }, .valid = { .min_access_size = 1, .max_access_size = 4 |