[PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-14 Thread Peter Maydell
The cadence UART attempts to avoid allowing the guset to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that a malicious guest can get a bogus value into

Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-14 Thread Thomas Huth
On 14/03/2023 18.08, Peter Maydell wrote: The cadence UART attempts to avoid allowing the guset to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that

Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-14 Thread Edgar E. Iglesias
On Tue, Mar 14, 2023 at 6:08 PM Peter Maydell wrote: > The cadence UART attempts to avoid allowing the guset to set invalid > baud rate register values in the uart_write() function. However it > does the "mask to the size of the register field" and "check for > invalid values" in the wrong order

Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-14 Thread Wilfred Mallawa
On Tue, 2023-03-14 at 17:08 +, Peter Maydell wrote: > The cadence UART attempts to avoid allowing the guset to set invalid > baud rate register values in the uart_write() function.  However it > does the "mask to the size of the register field" and "check for > invalid values" in the wrong orde

Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-14 Thread Alistair Francis
On Wed, Mar 15, 2023 at 3:09 AM Peter Maydell wrote: > > The cadence UART attempts to avoid allowing the guset to set invalid > baud rate register values in the uart_write() function. However it > does the "mask to the size of the register field" and "check for > invalid values" in the wrong orde

Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-15 Thread Philippe Mathieu-Daudé
On 14/3/23 18:08, Peter Maydell wrote: The cadence UART attempts to avoid allowing the guset to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that a m

Re: [PATCH for-8.0] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

2023-03-15 Thread Qiang Liu
On 3/14/23 6:08 PM, Peter Maydell wrote: The cadence UART attempts to avoid allowing the guset to set invalid baud rate register values in the uart_write() function. However it does the "mask to the size of the register field" and "check for invalid values" in the wrong order, which means that