diff options
author | Andrew Waterman <andrew@sifive.com> | 2024-02-14 13:40:29 -0800 |
---|---|---|
committer | Andrew Waterman <andrew@sifive.com> | 2024-02-14 14:06:12 -0800 |
commit | b08054f7344b65ab97a6454e9ef05b9657a55881 (patch) | |
tree | c018fdb2c261dc96d499b28c19e6101264d2aa5c | |
parent | 3a53c80ade3336b1d46c9db3a6c6be8311c32cc5 (diff) | |
download | spike-b08054f7344b65ab97a6454e9ef05b9657a55881.zip spike-b08054f7344b65ab97a6454e9ef05b9657a55881.tar.gz spike-b08054f7344b65ab97a6454e9ef05b9657a55881.tar.bz2 |
Reduce NS16550 address space size to one page
..rather than unbounded, as it used to be. This led to the rather
surprising issue #1600, where a part of the address space assumed to be
vacant would allow a subset of accesses.
-rw-r--r-- | riscv/ns16550.cc | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/riscv/ns16550.cc b/riscv/ns16550.cc index a74aa74..e0b3251 100644 --- a/riscv/ns16550.cc +++ b/riscv/ns16550.cc @@ -2,6 +2,7 @@ #include <sstream> #include "devices.h" #include "processor.h" +#include "mmu.h" #include "term.h" #include "sim.h" #include "dts.h" @@ -170,6 +171,9 @@ bool ns16550_t::load(reg_t addr, size_t len, uint8_t* bytes) if (reg_io_width != len) { return false; } + if (addr + len > PGSIZE) { + return false; + } addr >>= reg_shift; addr &= 7; @@ -230,6 +234,9 @@ bool ns16550_t::store(reg_t addr, size_t len, const uint8_t* bytes) if (reg_io_width != len) { return false; } + if (addr + len > PGSIZE) { + return false; + } addr >>= reg_shift; addr &= 7; val = bytes[0]; |