Commit 526668c7 authored by Philippe Mathieu-Daudé's avatar Philippe Mathieu-Daudé Committed by Peter Maydell
Browse files

hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[] 

Both lqspi_read() and lqspi_load_cache() expect a 32-bit
aligned address.

>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':

  Transfer Size Limitations

    Because of the 32-bit wide TX, RX, and generic FIFO, all
    APB/AXI transfers must be an integer multiple of 4-bytes.
    Shorter transfers are not possible.

Set MemoryRegionOps.impl values to force 32-bit accesses,
this way we are sure we do not access the lqspi_buf[] array
out of bound.

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf



Reviewed-by: default avatarFrancisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: default avatarFrancisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 936a236c

hw/ssi/xilinx_spips.c

+4 −0
Original line number Diff line number Diff line
@@ -1239,6 +1239,10 @@ static const MemoryRegionOps lqspi_ops = { 
    .read_with_attrs = lqspi_read,

    .write_with_attrs = lqspi_write,

    .endianness = DEVICE_NATIVE_ENDIAN,

    .impl = {

        .min_access_size = 4,

        .max_access_size = 4,

    },

    .valid = {

        .min_access_size = 1,

        .max_access_size = 4