* [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
@ 2021-08-16 18:36 ` David Hoppenbrouwers
0 siblings, 0 replies; 8+ messages in thread
From: David Hoppenbrouwers @ 2021-08-16 18:36 UTC (permalink / raw)
To: qemu-devel
Cc: Bin Meng, Palmer Dabbelt, David Hoppenbrouwers, Alistair Francis,
open list:SiFive Machines
`next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
resulted in high values such as `UINT64_MAX` being converted to `-1`,
which caused an immediate timer interrupt.
By limiting `next` to `INT64_MAX` no overflow will happen while the
timer will still be effectively set to "infinitely" far in the future.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
---
I wrongly used `MAX` instead of `MIN`. I've amended the patch.
hw/intc/sifive_clint.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
index 0f41e5ea1c..de47571fca 100644
--- a/hw/intc/sifive_clint.c
+++ b/hw/intc/sifive_clint.c
@@ -61,6 +61,8 @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
/* back to ns (note args switched in muldiv64) */
next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
+ /* ensure next does not overflow, as timer_mod takes a signed value */
+ next = MIN(next, INT64_MAX);
timer_mod(cpu->env.timer, next);
}
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
@ 2021-08-16 18:36 ` David Hoppenbrouwers
0 siblings, 0 replies; 8+ messages in thread
From: David Hoppenbrouwers @ 2021-08-16 18:36 UTC (permalink / raw)
To: qemu-devel
Cc: David Hoppenbrouwers, Alistair Francis, Bin Meng, Palmer Dabbelt,
open list:SiFive Machines
`next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
resulted in high values such as `UINT64_MAX` being converted to `-1`,
which caused an immediate timer interrupt.
By limiting `next` to `INT64_MAX` no overflow will happen while the
timer will still be effectively set to "infinitely" far in the future.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
---
I wrongly used `MAX` instead of `MIN`. I've amended the patch.
hw/intc/sifive_clint.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
index 0f41e5ea1c..de47571fca 100644
--- a/hw/intc/sifive_clint.c
+++ b/hw/intc/sifive_clint.c
@@ -61,6 +61,8 @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
/* back to ns (note args switched in muldiv64) */
next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
+ /* ensure next does not overflow, as timer_mod takes a signed value */
+ next = MIN(next, INT64_MAX);
timer_mod(cpu->env.timer, next);
}
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
2021-08-16 18:36 ` David Hoppenbrouwers
@ 2021-08-17 3:24 ` Alistair Francis
-1 siblings, 0 replies; 8+ messages in thread
From: Alistair Francis @ 2021-08-17 3:24 UTC (permalink / raw)
To: David Hoppenbrouwers
Cc: Alistair Francis, Bin Meng, Palmer Dabbelt,
qemu-devel@nongnu.org Developers, open list:SiFive Machines
On Tue, Aug 17, 2021 at 4:39 AM David Hoppenbrouwers <david@salt-inc.org> wrote:
>
> `next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
> resulted in high values such as `UINT64_MAX` being converted to `-1`,
> which caused an immediate timer interrupt.
>
> By limiting `next` to `INT64_MAX` no overflow will happen while the
> timer will still be effectively set to "infinitely" far in the future.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
> Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> I wrongly used `MAX` instead of `MIN`. I've amended the patch.
>
> hw/intc/sifive_clint.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
> index 0f41e5ea1c..de47571fca 100644
> --- a/hw/intc/sifive_clint.c
> +++ b/hw/intc/sifive_clint.c
> @@ -61,6 +61,8 @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
> /* back to ns (note args switched in muldiv64) */
> next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
> muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
> + /* ensure next does not overflow, as timer_mod takes a signed value */
> + next = MIN(next, INT64_MAX);
> timer_mod(cpu->env.timer, next);
> }
>
> --
> 2.20.1
>
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
@ 2021-08-17 3:24 ` Alistair Francis
0 siblings, 0 replies; 8+ messages in thread
From: Alistair Francis @ 2021-08-17 3:24 UTC (permalink / raw)
To: David Hoppenbrouwers
Cc: qemu-devel@nongnu.org Developers, Bin Meng, Palmer Dabbelt,
Alistair Francis, open list:SiFive Machines
On Tue, Aug 17, 2021 at 4:39 AM David Hoppenbrouwers <david@salt-inc.org> wrote:
>
> `next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
> resulted in high values such as `UINT64_MAX` being converted to `-1`,
> which caused an immediate timer interrupt.
>
> By limiting `next` to `INT64_MAX` no overflow will happen while the
> timer will still be effectively set to "infinitely" far in the future.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
> Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> I wrongly used `MAX` instead of `MIN`. I've amended the patch.
>
> hw/intc/sifive_clint.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
> index 0f41e5ea1c..de47571fca 100644
> --- a/hw/intc/sifive_clint.c
> +++ b/hw/intc/sifive_clint.c
> @@ -61,6 +61,8 @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
> /* back to ns (note args switched in muldiv64) */
> next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
> muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
> + /* ensure next does not overflow, as timer_mod takes a signed value */
> + next = MIN(next, INT64_MAX);
> timer_mod(cpu->env.timer, next);
> }
>
> --
> 2.20.1
>
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
2021-08-16 18:36 ` David Hoppenbrouwers
@ 2021-08-17 7:59 ` Bin Meng
-1 siblings, 0 replies; 8+ messages in thread
From: Bin Meng @ 2021-08-17 7:59 UTC (permalink / raw)
To: David Hoppenbrouwers
Cc: Alistair Francis, Bin Meng, Palmer Dabbelt,
qemu-devel@nongnu.org Developers, open list:SiFive Machines
On Tue, Aug 17, 2021 at 2:38 AM David Hoppenbrouwers <david@salt-inc.org> wrote:
>
> `next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
> resulted in high values such as `UINT64_MAX` being converted to `-1`,
> which caused an immediate timer interrupt.
>
> By limiting `next` to `INT64_MAX` no overflow will happen while the
> timer will still be effectively set to "infinitely" far in the future.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
> Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
> ---
> I wrongly used `MAX` instead of `MIN`. I've amended the patch.
>
> hw/intc/sifive_clint.c | 2 ++
> 1 file changed, 2 insertions(+)
>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
@ 2021-08-17 7:59 ` Bin Meng
0 siblings, 0 replies; 8+ messages in thread
From: Bin Meng @ 2021-08-17 7:59 UTC (permalink / raw)
To: David Hoppenbrouwers
Cc: qemu-devel@nongnu.org Developers, Bin Meng, Palmer Dabbelt,
Alistair Francis, open list:SiFive Machines
On Tue, Aug 17, 2021 at 2:38 AM David Hoppenbrouwers <david@salt-inc.org> wrote:
>
> `next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
> resulted in high values such as `UINT64_MAX` being converted to `-1`,
> which caused an immediate timer interrupt.
>
> By limiting `next` to `INT64_MAX` no overflow will happen while the
> timer will still be effectively set to "infinitely" far in the future.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
> Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
> ---
> I wrongly used `MAX` instead of `MIN`. I've amended the patch.
>
> hw/intc/sifive_clint.c | 2 ++
> 1 file changed, 2 insertions(+)
>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
2021-08-17 7:59 ` Bin Meng
@ 2021-08-19 0:13 ` Alistair Francis
-1 siblings, 0 replies; 8+ messages in thread
From: Alistair Francis @ 2021-08-19 0:13 UTC (permalink / raw)
To: Bin Meng
Cc: open list:SiFive Machines, Bin Meng,
qemu-devel@nongnu.org Developers, Palmer Dabbelt,
Alistair Francis, David Hoppenbrouwers
On Tue, Aug 17, 2021 at 6:00 PM Bin Meng <bmeng.cn@gmail.com> wrote:
>
> On Tue, Aug 17, 2021 at 2:38 AM David Hoppenbrouwers <david@salt-inc.org> wrote:
> >
> > `next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
> > resulted in high values such as `UINT64_MAX` being converted to `-1`,
> > which caused an immediate timer interrupt.
> >
> > By limiting `next` to `INT64_MAX` no overflow will happen while the
> > timer will still be effectively set to "infinitely" far in the future.
> >
> > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
> > Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
> > ---
> > I wrongly used `MAX` instead of `MIN`. I've amended the patch.
> >
> > hw/intc/sifive_clint.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
>
> Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Thanks!
Applied to riscv-to-apply.next
Alistair
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp()
@ 2021-08-19 0:13 ` Alistair Francis
0 siblings, 0 replies; 8+ messages in thread
From: Alistair Francis @ 2021-08-19 0:13 UTC (permalink / raw)
To: Bin Meng
Cc: David Hoppenbrouwers, Alistair Francis, Bin Meng, Palmer Dabbelt,
qemu-devel@nongnu.org Developers, open list:SiFive Machines
On Tue, Aug 17, 2021 at 6:00 PM Bin Meng <bmeng.cn@gmail.com> wrote:
>
> On Tue, Aug 17, 2021 at 2:38 AM David Hoppenbrouwers <david@salt-inc.org> wrote:
> >
> > `next` is an `uint64_t` value, but `timer_mod` takes an `int64_t`. This
> > resulted in high values such as `UINT64_MAX` being converted to `-1`,
> > which caused an immediate timer interrupt.
> >
> > By limiting `next` to `INT64_MAX` no overflow will happen while the
> > timer will still be effectively set to "infinitely" far in the future.
> >
> > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/493
> > Signed-off-by: David Hoppenbrouwers <david@salt-inc.org>
> > ---
> > I wrongly used `MAX` instead of `MIN`. I've amended the patch.
> >
> > hw/intc/sifive_clint.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
>
> Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Thanks!
Applied to riscv-to-apply.next
Alistair
>
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-08-19 0:15 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-16 18:36 [PATCH v2] hw/intc/sifive_clint: Fix overflow in sifive_clint_write_timecmp() David Hoppenbrouwers
2021-08-16 18:36 ` David Hoppenbrouwers
2021-08-17 3:24 ` Alistair Francis
2021-08-17 3:24 ` Alistair Francis
2021-08-17 7:59 ` Bin Meng
2021-08-17 7:59 ` Bin Meng
2021-08-19 0:13 ` Alistair Francis
2021-08-19 0:13 ` Alistair Francis
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.