mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

char: cadence: check baud rate generator and divider values

Browse Source 
The Cadence UART device emulator calculates speed by dividing the
baud rate by a 'baud rate generator' & 'baud rate divider' value.
The device specification defines these register values to be
non-zero and within certain limits. Add checks for these limits
to avoid errors like divide by zero.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1477596278-1470-1-git-send-email-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Prasad J Pandit 2016-11-07 10:00:24 +00:00 committed by Peter Maydell
parent 9226682a40
commit 6e29651c5e
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
hw/char/cadence_uart.c
View File

@ -1,6 +1,11 @@
/*
* Device model for Cadence UART
*
* Reference: Xilinx Zynq 7000 reference manual
* - http://www.xilinx.com/support/documentation/user_guides/ug585-Zynq-7000-TRM.pdf
* - Chapter 19 UART Controller
* - Appendix B for Register details
*
* Copyright (c) 2010 Xilinx Inc.
* Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
* Copyright (c) 2012 PetaLogix Pty Ltd.
@ -402,6 +407,16 @@ static void uart_write(void *opaque, hwaddr offset,
break;
}
break;
case R_BRGR: /* Baud rate generator */
if (value >= 0x01) {
s->r[offset] = value & 0xFFFF;
}
break;
case R_BDIV: /* Baud rate divider */
if (value >= 0x04) {
s->r[offset] = value & 0xFF;
}
break;
default:
s->r[offset] = value;
}