On 3 October 2016 at 10:04, P J P <ppan...@redhat.com> wrote: > From: Prasad J Pandit <p...@fedoraproject.org> > > ARM A9MP processor has a peripheral timer with an auto-increment > register, which holds an increment step value. A user could set > this value to zero. When auto-increment control bit is enabled, > it leads to an infinite loop in 'a9_gtimer_update' while > updating comparator value. Remove this loop incrementing the > comparator value. > > Reported-by: Li Qiang <liqiang...@360.cn> > Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> > --- > hw/timer/a9gtimer.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > > Update per: > -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg00079.html > > diff --git a/hw/timer/a9gtimer.c b/hw/timer/a9gtimer.c > index 772f85f..add2f31 100644 > --- a/hw/timer/a9gtimer.c > +++ b/hw/timer/a9gtimer.c > @@ -73,6 +73,7 @@ static void a9_gtimer_update(A9GTimerState *s, bool sync) > > A9GTimerUpdate update = a9_gtimer_get_update(s); > int i; > + uint64_t inc; > int64_t next_cdiff = 0; > > for (i = 0; i < s->num_cpu; ++i) { > @@ -82,16 +83,15 @@ static void a9_gtimer_update(A9GTimerState *s, bool sync) > if ((s->control & R_CONTROL_TIMER_ENABLE) && > (gtb->control & R_CONTROL_COMP_ENABLE)) { > /* R2p0+, where the compare function is >= */ > - while (gtb->compare < update.new) { > + if (gtb->compare < update.new > + && gtb->control & R_CONTROL_AUTO_INCREMENT) { > DB_PRINT("Compare event happened for CPU %d\n", i); > gtb->status = 1; > - if (gtb->control & R_CONTROL_AUTO_INCREMENT) { > - DB_PRINT("Auto incrementing timer compare by %" PRId32 > "\n", > - gtb->inc); > - gtb->compare += gtb->inc; > - } else { > - break; > - } > + inc = update.new - gtb->compare - 1; > + inc = gtb->inc ? QEMU_ALIGN_DOWN(inc, gtb->inc) : 0; > + DB_PRINT("Auto incrementing timer compare by %" > + PRId64 "\n", inc); > + gtb->compare += inc; > } > cdiff = (int64_t)gtb->compare - (int64_t)update.new + 1; > if (cdiff > 0 && (cdiff < next_cdiff || !next_cdiff)) {
This is still losing the setting of gtb->status in the case where the auto-increment bit is not set. thanks -- PMM
