[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 16/20] hw/misc/zynq_slcr: Avoid #DIV/0! error
From: |
Peter Maydell |
Subject: |
[PULL 16/20] hw/misc/zynq_slcr: Avoid #DIV/0! error |
Date: |
Tue, 15 Dec 2020 14:12:33 +0000 |
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
Malicious user can set the feedback divisor for the PLLs
to zero, triggering a floating-point exception (SIGFPE).
As the datasheet [*] is not clear how hardware behaves
when these bits are zeroes, use the maximum divisor
possible (128) to avoid the software FPE.
[*] Zynq-7000 TRM, UG585 (v1.12.2)
B.28 System Level Control Registers (slcr)
-> "Register (slcr) ARM_PLL_CTRL"
25.10.4 PLLs
-> "Software-Controlled PLL Update"
Fixes: 38867cb7ec9 ("hw/misc/zynq_slcr: add clock generation for uarts")
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
Message-id: 20201210141610.884600-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/zynq_slcr.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index a2b28019e3c..66504a9d3ab 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -217,6 +217,11 @@ static uint64_t zynq_slcr_compute_pll(uint64_t input,
uint32_t ctrl_reg)
return 0;
}
+ /* Consider zero feedback as maximum divide ratio possible */
+ if (!mult) {
+ mult = 1 << R_xxx_PLL_CTRL_PLL_FPDIV_LENGTH;
+ }
+
/* frequency multiplier -> period division */
return input / mult;
}
--
2.20.1
- [PULL 03/20] hw/openrisc/openrisc_sim: Abstract out "get IRQ x of CPU y", (continued)
- [PULL 03/20] hw/openrisc/openrisc_sim: Abstract out "get IRQ x of CPU y", Peter Maydell, 2020/12/15
- [PULL 07/20] target/nios2: Use deposit32() to update ipending register, Peter Maydell, 2020/12/15
- [PULL 10/20] elf_ops.h: Don't truncate name of the ROM blobs we create, Peter Maydell, 2020/12/15
- [PULL 09/20] hw/core/loader.c: Improve reporting of ROM overlap errors, Peter Maydell, 2020/12/15
- [PULL 06/20] target/nios2: Move nios2_check_interrupts() into target/nios2, Peter Maydell, 2020/12/15
- [PULL 11/20] elf_ops.h: Be more verbose with ROM blob names, Peter Maydell, 2020/12/15
- [PULL 01/20] gdbstub: Correct misparsing of vCont C/S requests, Peter Maydell, 2020/12/15
- [PULL 15/20] arm: xlnx-versal: Connect usb to virt-versal, Peter Maydell, 2020/12/15
- [PULL 14/20] usb: xlnx-usb-subsystem: Add xilinx usb subsystem, Peter Maydell, 2020/12/15
- [PULL 13/20] usb: Add DWC3 model, Peter Maydell, 2020/12/15
- [PULL 16/20] hw/misc/zynq_slcr: Avoid #DIV/0! error,
Peter Maydell <=
- [PULL 17/20] hw/block/m25p80: Make Numonyx config field names more accurate, Peter Maydell, 2020/12/15
- [PULL 08/20] hw/core/loader.c: Track last-seen ROM in rom_check_and_register_reset(), Peter Maydell, 2020/12/15
- [PULL 12/20] usb: Add versal-usb2-ctrl-regs module, Peter Maydell, 2020/12/15
- [PULL 18/20] hw/block/m25p80: Fix when VCFG XIP bit is set for Numonyx, Peter Maydell, 2020/12/15
- [PULL 20/20] hw/block/m25p80: Fix Numonyx fast read dummy cycle count, Peter Maydell, 2020/12/15
[PULL 19/20] hw/block/m25p80: Check SPI mode before running some Numonyx commands, Peter Maydell, 2020/12/15