[Qemu-devel] [PATCH v2] char: cadence: check baud rate generator and divider values

[P J P <ppandit@redhat.com>]

From: Prasad J Pandit <pjp@fedoraproject.org>

The Cadence UART device emulator calculates speed by dividing the
baud rate by a 'baud rate generator' & 'baud rate divider' value.
The device specification defines these register values to be
non-zero and within certain limits. Add checks for these limits
to avoid errors like divide by zero.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/char/cadence_uart.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

Update: set register values as per the specification
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04931.html

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index e3bc52f..c176446 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -1,5 +1,6 @@
 /*
  * Device model for Cadence UART
+ *  -> http://www.xilinx.com/support/documentation/user_guides/ug585-Zynq-7000-TRM.pdf
  *
  * Copyright (c) 2010 Xilinx Inc.
  * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
@@ -410,6 +411,18 @@ static void uart_write(void *opaque, hwaddr offset,
             break;
         }
         break;
+    case R_BRGR: /* Baud rate generator */
+        s->r[offset] = 0x028B; /* default reset value */
+        if (value >= 0x01 && value <= 0xFFFF) {
+            s->r[offset] = value;
+        }
+        break;
+    case R_BDIV:    /* Baud rate divider */
+        s->r[offset] = 0x0F;
+        if (value >= 0x04 && value <= 0xFF) {
+            s->r[offset] = value;
+        }
+        break;
     default:
         s->r[offset] = value;
     }
-- 
2.7.4