diff mbox

[PULL,17/17] hw/arm/omap_gpmc: Avoid buffer overrun filling prefetch FIFO

Message ID 1399995099-26635-18-git-send-email-peter.maydell@linaro.org
State Accepted
Commit 89f26e6b7b5e5c9657f2abd6ef5a336bea11add2
Headers show

Commit Message

Peter Maydell May 13, 2014, 3:31 p.m. UTC 
In fill_prefetch_fifo(), if the device we are reading from is 16 bit,
then we must not try to transfer an odd number of bytes into the FIFO.
This could otherwise have resulted in our overrunning the prefetch.fifo
array by one byte.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
---
 hw/misc/omap_gpmc.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox

Patch

diff --git a/hw/misc/omap_gpmc.c b/hw/misc/omap_gpmc.c
index 2047274..cddea24 100644
--- a/hw/misc/omap_gpmc.c
+++ b/hw/misc/omap_gpmc.c
@@ -242,6 +242,10 @@  static void fill_prefetch_fifo(struct omap_gpmc_s *s)
     if (bytes > s->prefetch.count) {
         bytes = s->prefetch.count;
     }
+    if (is16bit) {
+        bytes &= ~1;
+    }
+
     s->prefetch.count -= bytes;
     s->prefetch.fifopointer += bytes;
     fptr = 64 - s->prefetch.fifopointer;