From: Don Slutz Date: Fri, 2 May 2014 20:18:02 +0000 (-0400) Subject: hvm/hpet: Correctly limit period to a maximum. X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~5051 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks://%22/%22http:/www.example.com/cgi/%22https:/%22bookmarks:/%22?a=commitdiff_plain;h=825e70b1ec9df2a2d9f949232c4a368a0ea77416;p=xen.git hvm/hpet: Correctly limit period to a maximum. In the code section after the comment: /* * Clamp period to reasonable min/max values: * - minimum is 100us, same as timers controlled by vpt.c * - maximum is to prevent overflow in time_after() calculations */ The current maximum limit actually allows "bad" values like 0 and 1. This is because it uses a mask not a maximum. Signed-off-by: Don Slutz Reviewed-by: Jan Beulich Acked-by: Tim Deegan --- diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c index 910d87d732..c64c5471ac 100644 --- a/xen/arch/x86/hvm/hpet.c +++ b/xen/arch/x86/hvm/hpet.c @@ -404,6 +404,8 @@ static int hpet_write( if ( timer_is_periodic(h, tn) && !(h->hpet.timers[tn].config & HPET_TN_SETVAL) ) { + uint64_t max_period = (timer_is_32bit(h, tn) ? ~0u : ~0ull) >> 1; + /* * Clamp period to reasonable min/max values: * - minimum is 100us, same as timers controlled by vpt.c @@ -411,7 +413,8 @@ static int hpet_write( */ if ( hpet_tick_to_ns(h, new_val) < MICROSECS(100) ) new_val = (MICROSECS(100) << 10) / h->hpet_to_ns_scale; - new_val &= (timer_is_32bit(h, tn) ? ~0u : ~0ull) >> 1; + if ( new_val > max_period ) + new_val = max_period; h->hpet.period[tn] = new_val; } else