aboutsummaryrefslogtreecommitdiff
path: root/hw/gpio/bcm2835_gpio.c
diff options
context:
space:
mode:
authorNicholas Piggin <npiggin@gmail.com>2023-05-30 23:12:12 +1000
committerDaniel Henrique Barboza <danielhb413@gmail.com>2023-06-10 10:19:24 -0300
commit09d2db9f46e38e2da990df8ad914d735d764251a (patch)
treeec7ab4817bf2144def773e69dc798047f2a96810 /hw/gpio/bcm2835_gpio.c
parent21ee07e7737a2dbba226a8d8192246e51855910d (diff)
downloadqemu-09d2db9f46e38e2da990df8ad914d735d764251a.zip
qemu-09d2db9f46e38e2da990df8ad914d735d764251a.tar.gz
qemu-09d2db9f46e38e2da990df8ad914d735d764251a.tar.bz2
target/ppc: Fix decrementer time underflow and infinite timer loop
It is possible to store a very large value to the decrementer that it does not raise the decrementer exception so the timer is scheduled, but the next time value wraps and is treated as in the past. This can occur if (u64)-1 is stored on a zero-triggered exception, or (u64)-1 is stored twice on an underflow-triggered exception, for example. If such a value is set in DECAR, it gets stored to the decrementer by the timer function, which then immediately causes another timer, which hangs QEMU. Clamp the decrementer to the implemented width, and use that as the value for the timer calculation, effectively preventing this overflow. Reported-by: sdicaro@DDCI.com Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230530131214.373524-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Diffstat (limited to 'hw/gpio/bcm2835_gpio.c')
0 files changed, 0 insertions, 0 deletions