Commit 6e29651c authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Peter Maydell
Browse files

char: cadence: check baud rate generator and divider values 



The Cadence UART device emulator calculates speed by dividing the
baud rate by a 'baud rate generator' & 'baud rate divider' value.
The device specification defines these register values to be
non-zero and within certain limits. Add checks for these limits
to avoid errors like divide by zero.

Reported-by: default avatarHuawei PSIRT <psirt@huawei.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: default avatarAlistair Francis <alistair.francis@xilinx.com>
Message-id: 1477596278-1470-1-git-send-email-ppandit@redhat.com
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 9226682a

hw/char/cadence_uart.c

+15 −0
Original line number Diff line number Diff line 
/*

 * Device model for Cadence UART

 *

 * Reference: Xilinx Zynq 7000 reference manual

 *   - http://www.xilinx.com/support/documentation/user_guides/ug585-Zynq-7000-TRM.pdf

 *   - Chapter 19 UART Controller

 *   - Appendix B for Register details

 *

 * Copyright (c) 2010 Xilinx Inc.

 * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)

 * Copyright (c) 2012 PetaLogix Pty Ltd.
@@ -402,6 +407,16 @@ static void uart_write(void *opaque, hwaddr offset, 
            break;

        }

        break;

    case R_BRGR: /* Baud rate generator */

        if (value >= 0x01) {

            s->r[offset] = value & 0xFFFF;

        }

        break;

    case R_BDIV:    /* Baud rate divider */

        if (value >= 0x04) {

            s->r[offset] = value & 0xFF;

        }

        break;

    default:

        s->r[offset] = value;

    }