Reduce NS16550 address space size to one page

..rather than unbounded, as it used to be.  This led to the rather
surprising issue #1600, where a part of the address space assumed to be
vacant would allow a subset of accesses.

1 files changed, 7 insertions, 0 deletions

diff --git a/riscv/ns16550.cc b/riscv/ns16550.cc
index a74aa74..e0b3251 100644
--- a/riscv/ns16550.cc
+++ b/riscv/ns16550.cc
@@ -2,6 +2,7 @@
 #include <sstream>
 #include "devices.h"
 #include "processor.h"
+#include "mmu.h"
 #include "term.h"
 #include "sim.h"
 #include "dts.h"
@@ -170,6 +171,9 @@ bool ns16550_t::load(reg_t addr, size_t len, uint8_t* bytes)
   if (reg_io_width != len) {
     return false;
   }
+  if (addr + len > PGSIZE) {
+    return false;
+  }
   addr >>= reg_shift;
   addr &= 7;
 
@@ -230,6 +234,9 @@ bool ns16550_t::store(reg_t addr, size_t len, const uint8_t* bytes)
   if (reg_io_width != len) {
     return false;
   }
+  if (addr + len > PGSIZE) {
+    return false;
+  }
   addr >>= reg_shift;
   addr &= 7;
   val = bytes[0];