Commit 936a236c authored by Philippe Mathieu-Daudé's avatar Philippe Mathieu-Daudé Committed by Peter Maydell
Browse files

hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory 

Lei Sun found while auditing the code that a CPU write would
trigger a NULL pointer dereference.

>From UG1085 datasheet [*] AXI writes in this region are ignored
and generates an AXI Slave Error (SLVERR).

Fix by implementing the write_with_attrs() handler.
Return MEMTX_ERROR when the region is accessed (this error maps
to an AXI slave error).

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf



Reported-by: default avatarLei Sun <slei.casper@gmail.com>
Reviewed-by: default avatarFrancisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: default avatarFrancisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 5937bd50

hw/ssi/xilinx_spips.c

+16 −0
Original line number Diff line number Diff line
@@ -1220,8 +1220,24 @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value, 
    return lqspi_read(opaque, addr, value, size, attrs);

}



static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,

                               unsigned size, MemTxAttrs attrs)

{

    /*

     * From UG1085, Chapter 24 (Quad-SPI controllers):

     * - Writes are ignored

     * - AXI writes generate an external AXI slave error (SLVERR)

     */

    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64

                                   " (value: 0x%" PRIx64 "\n",

                  __func__, size << 3, offset, value);



    return MEMTX_ERROR;

}



static const MemoryRegionOps lqspi_ops = {

    .read_with_attrs = lqspi_read,

    .write_with_attrs = lqspi_write,

    .endianness = DEVICE_NATIVE_ENDIAN,

    .valid = {

        .min_access_size = 1,