From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59863) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c2oxb-0004QA-0q for qemu-devel@nongnu.org; Fri, 04 Nov 2016 20:35:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c2oxV-00032v-RB for qemu-devel@nongnu.org; Fri, 04 Nov 2016 20:35:50 -0400 Received: from mail-bl2nam02on0086.outbound.protection.outlook.com ([104.47.38.86]:45091 helo=NAM02-BL2-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c2oxV-00031j-LT for qemu-devel@nongnu.org; Fri, 04 Nov 2016 20:35:45 -0400 From: Alistair Francis Date: Fri, 4 Nov 2016 17:00:31 -0700 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Subject: [Qemu-devel] [PATCH v1 1/1] cadence_uart: Check baud rate generator and divider values on migration List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org, peter.maydell@linaro.org Cc: alistair.francis@xilinx.com, alistair23@gmail.com, pjp@fedoraproject.org, psirt@huawei.com The Cadence UART device emulator calculates speed by dividing the baud rate by a 'baud rate generator' & 'baud rate divider' value. The device specification defines these register values to be non-zero and within certain limits. Checks were recently added when writing to these registers but not when restoring from migration. This patch adds checks when restoring from migration to avoid divide by zero errors. Reported-by: Huawei PSIRT Signed-off-by: Alistair Francis --- hw/char/cadence_uart.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c index def34cd..e3a6248 100644 --- a/hw/char/cadence_uart.c +++ b/hw/char/cadence_uart.c @@ -487,6 +487,19 @@ static int cadence_uart_post_load(void *opaque, int version_id) { CadenceUARTState *s = opaque; + /* Ensure these two aren't invalid numbers */ + if (s->r[R_BRGR] <= 1) { + /* Value is invalid, reset it */ + s->r[R_BRGR] = 0x0000028B; + } + if (s->r[R_BDIV] <= 3) { + /* Value is invalid, reset it */ + s->r[R_BDIV] = 0x0000000F; + } + + s->r[R_BRGR] = s->r[R_BRGR] & 0xFFFF; + s->r[R_BDIV] = s->r[R_BDIV] & 0xFF; + uart_parameters_setup(s); uart_update_status(s); return 0; -- 2.7.4