[Xen-changelog] [qemu-xen master] char: cadence: check baud rate generator and divider values

[patchbot@xxxxxxx]

commit 6e29651c5e3a0e0336818574f273b3f6ecea491d
Author:     Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx>
AuthorDate: Mon Nov 7 10:00:24 2016 +0000
Commit:     Peter Maydell <peter.maydell@xxxxxxxxxx>
CommitDate: Mon Nov 7 10:00:24 2016 +0000

    char: cadence: check baud rate generator and divider values
    
    The Cadence UART device emulator calculates speed by dividing the
    baud rate by a 'baud rate generator' & 'baud rate divider' value.
    The device specification defines these register values to be
    non-zero and within certain limits. Add checks for these limits
    to avoid errors like divide by zero.
    
    Reported-by: Huawei PSIRT <psirt@xxxxxxxxxx>
    Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx>
    Reviewed-by: Alistair Francis <alistair.francis@xxxxxxxxxx>
    Message-id: 1477596278-1470-1-git-send-email-ppandit@xxxxxxxxxx
    Signed-off-by: Peter Maydell <peter.maydell@xxxxxxxxxx>
---
 hw/char/cadence_uart.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index def34cd..0215d65 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -1,6 +1,11 @@
 /*
  * Device model for Cadence UART
  *
+ * Reference: Xilinx Zynq 7000 reference manual
+ *   - 
http://www.xilinx.com/support/documentation/user_guides/ug585-Zynq-7000-TRM.pdf
+ *   - Chapter 19 UART Controller
+ *   - Appendix B for Register details
+ *
  * Copyright (c) 2010 Xilinx Inc.
  * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@xxxxxxxxxxxxx)
  * Copyright (c) 2012 PetaLogix Pty Ltd.
@@ -402,6 +407,16 @@ static void uart_write(void *opaque, hwaddr offset,
             break;
         }
         break;
+    case R_BRGR: /* Baud rate generator */
+        if (value >= 0x01) {
+            s->r[offset] = value & 0xFFFF;
+        }
+        break;
+    case R_BDIV:    /* Baud rate divider */
+        if (value >= 0x04) {
+            s->r[offset] = value & 0xFF;
+        }
+        break;
     default:
         s->r[offset] = value;
     }
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog