When writing a new period, the clamping should use a maximum value rather tyhan a bit mask. Also, when writing the high bits new_val is shifted right by 32, so the maximum allowed period should also be shifted right.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- hw/timer/hpet.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c index 01efe4885db..ad881448bf3 100644 --- a/hw/timer/hpet.c +++ b/hw/timer/hpet.c @@ -548,7 +548,9 @@ static void hpet_ram_write(void *opaque, hwaddr addr, * FIXME: Clamp period to reasonable min value? * Clamp period to reasonable max value */ - new_val &= (timer->config & HPET_TN_32BIT ? ~0u : ~0ull) >> 1; + if (timer->config & HPET_TN_32BIT) { + new_val = MIN(new_val, ~0u >> 1); + } timer->period = (timer->period & 0xffffffff00000000ULL) | new_val; } @@ -567,7 +569,7 @@ static void hpet_ram_write(void *opaque, hwaddr addr, * FIXME: Clamp period to reasonable min value? * Clamp period to reasonable max value */ - new_val &= (timer->config & HPET_TN_32BIT ? ~0u : ~0ull) >> 1; + new_val = MIN(new_val, ~0u >> 1); timer->period = (timer->period & 0xffffffffULL) | new_val << 32; } -- 2.45.2