Make sure the baudrate specified with the BR tag is somewhat sane.

A baudrate we consider insane is silently replaced with 0. When the
baudrate is 0, we will not try to program the hardware. Instead we
leave the communication speed unaltered, maximizing the chance to
have a working console. Obviously this means we allow specifying a
0 baudrate for exactly that purpose.

1 files changed, 20 insertions, 0 deletions

diff --git a/sys/dev/uart/uart_subr.c b/sys/dev/uart/uart_subr.c
index 4c40a36..27dfd41 100644
--- a/sys/dev/uart/uart_subr.c
+++ b/sys/dev/uart/uart_subr.c
@@ -242,6 +242,26 @@ uart_getenv(int devtype, struct uart_devinfo *di)
 	 */
 	if (addr == ~0U)
 		return (EINVAL);
+
+	/*
+	 * Accept only the well-known baudrates. Any invalid baudrate
+	 * is silently replaced with a 0-valued baudrate. The 0 baudrate
+	 * has special meaning. It means that we're not supposed to
+	 * program the baudrate and simply communicate with whatever
+	 * speed the hardware is currently programmed for.
+	 */
+	if (di->baudrate >= 19200) {
+		if (di->baudrate % 19200)
+			di->baudrate = 0;
+	} else if (di->baudrate >= 1200) {
+		if (di->baudrate % 1200)
+			di->baudrate = 0;
+	} else if (di->baudrate > 0) {
+		if (di->baudrate % 75)
+			di->baudrate = 0;
+	} else
+		di->baudrate = 0;
+
 	/* XXX the size of the mapping depends on the UART class. */
 	if (bus_space_map(di->bas.bst, addr, 8, 0, &di->bas.bsh) != 0)
 		return (EINVAL);