[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-ppc] [PULL 43/43] hw/ppc/ppc405_uc.c: Avoid integer overflows
From: |
David Gibson |
Subject: |
[Qemu-ppc] [PULL 43/43] hw/ppc/ppc405_uc.c: Avoid integer overflows |
Date: |
Wed, 22 Feb 2017 17:33:48 +1100 |
From: Peter Maydell <address@hidden>
When performing clock calculations, the ppc405_uc code
has several places where it multiplies together two
32-bit variables and assigns the result to a 64-bit
variable. This doesn't quite do what is intended because
C will compute a 32-bit multiply result. Add casts to
ensure we don't truncate the result.
(Spotted by Coverity, CID 1005504, 1005505.)
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: David Gibson <address@hidden>
---
hw/ppc/ppc405_uc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
index d6d3fc2..d5df94a 100644
--- a/hw/ppc/ppc405_uc.c
+++ b/hw/ppc/ppc405_uc.c
@@ -1881,7 +1881,7 @@ static void ppc405cr_clk_setup (ppc405cr_cpc_t *cpc)
D1 = (((cpc->pllmr >> 20) - 1) & 0xF) + 1; /* FBDV */
D2 = 8 - ((cpc->pllmr >> 16) & 0x7); /* FWDVA */
M = D0 * D1 * D2;
- VCO_out = cpc->sysclk * M;
+ VCO_out = (uint64_t)cpc->sysclk * M;
if (VCO_out < 400000000 || VCO_out > 800000000) {
/* PLL cannot lock */
cpc->pllmr &= ~0x80000000;
@@ -1892,7 +1892,7 @@ static void ppc405cr_clk_setup (ppc405cr_cpc_t *cpc)
/* Bypass PLL */
bypass_pll:
M = D0;
- PLL_out = cpc->sysclk * M;
+ PLL_out = (uint64_t)cpc->sysclk * M;
}
CPU_clk = PLL_out;
if (cpc->cr1 & 0x00800000)
@@ -2242,7 +2242,7 @@ static void ppc405ep_compute_clocks (ppc405ep_cpc_t *cpc)
#ifdef DEBUG_CLOCKS_LL
printf("FWDA %01" PRIx32 " %d\n", (cpc->pllmr[1] >> 16) & 0x7, D);
#endif
- VCO_out = cpc->sysclk * M * D;
+ VCO_out = (uint64_t)cpc->sysclk * M * D;
if (VCO_out < 500000000UL || VCO_out > 1000000000UL) {
/* Error - unlock the PLL */
printf("VCO out of range %" PRIu64 "\n", VCO_out);
--
2.9.3
- [Qemu-ppc] [PULL 31/43] hw/pci-host/prep: Do not use hw_error() in realize function, (continued)
- [Qemu-ppc] [PULL 31/43] hw/pci-host/prep: Do not use hw_error() in realize function, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 35/43] pc: pass apic_id to pc_find_cpu_slot() directly so lookup could be done without CPU object, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 39/43] machine: replace query_hotpluggable_cpus() callback with has_hotpluggable_cpus flag, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 24/43] softfloat: Add float128_to_uint32_round_to_zero(), David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 19/43] mac99: replace debug printf with trace points, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 10/43] target-ppc: Add xsmaxjdp and xsminjdp instructions, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 30/43] target/ppc/POWER9: Direct all instr and data storage interrupts to the hypv, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 28/43] target/ppc/POWER9: Add ISAv3.00 MMU definition, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 29/43] target/ppc/POWER9: Adapt LPCR handling for POWER9, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 36/43] change CPUArchId.cpu type to Object*, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 43/43] hw/ppc/ppc405_uc.c: Avoid integer overflows,
David Gibson <=
- [Qemu-ppc] [PULL 41/43] target-ppc: fix Book-E TLB matching, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 42/43] hw/ppc/spapr: Check for valid page size when hot plugging memory, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 38/43] machine: unify [pc_|spapr_]query_hotpluggable_cpus() callbacks, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 21/43] spapr: replace debug printf with trace points, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 34/43] pc: calculate topology only once when possible_cpus is initialised, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 33/43] pc: move pcms->possible_cpus init out of pc_cpus_init(), David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 25/43] target-ppc: Implement round to odd variants of quad FP instructions, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 32/43] machine: move possible_cpus to MachineState, David Gibson, 2017/02/22
- [Qemu-ppc] [PULL 40/43] hw/net/spapr_llan: 6 byte mac address device tree entry, David Gibson, 2017/02/22