[PATCH v3 17/17] sbsa-gwdt: limit compare_value to INT64_MAX

[Igor Mammedov <imammedo@redhat.com>]

QEMU timer subsystem uses int64_t, so WCV values with bit 63 set
overflow and cause the timer to fire immediately. The SBSA spec
defines WCV as an unsigned 64-bit compare value, so such values
are valid per spec and represent far-future deadlines (however
unpractical).

Windows in GTDT mode writes WCV in two 32-bit halves while the
watchdog is running:

 sbsa-gwdt_control_write [0x8]  <- 0xffffffff    # WOR (~4 sec)
 sbsa-gwdt_control_write [0x0]  <- 0x1           # WCS enable
 sbsa-gwdt_control_write [0x14] <- 0xffffffff    # WCVU (intermediate)
 sbsa-gwdt_control_write [0x10] <- 0xa906ca28    # WCVL
 sbsa-gwdt_control_write [0x14] <- 0xecb1        # WCVU (final)

The intermediate WCVU write (0xffffffff) creates a WCV above
INT64_MAX, which overflows QEMU's signed timer and fires
immediately — triggering WS0 => WS1 => reboot before the final
WCVU write lands.

Clamp WCV to INT64_MAX to avoid timer API overflow.

Note: Windows' GTDT watchdog usage is also fragile under
virtualization. It programs a short WOR (~4 sec), enables WCS,
and relies on a subsequent WCV write to push the deadline far
into the future — never using WRR for explicit refresh. On bare
metal the WCS=>WCV gap is negligible, but in a VM the vCPU can
be preempted between MMIO accesses while the clock keeps
ticking, potentially expiring the short WOR timeout before the
WCV override lands.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
---
 hw/watchdog/sbsa_gwdt.c        | 2 ++
 tests/qtest/bios-tables-test.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c
index fb67db9672..ff7adbcb0f 100644
--- a/hw/watchdog/sbsa_gwdt.c
+++ b/hw/watchdog/sbsa_gwdt.c
@@ -122,6 +122,8 @@ static void sbsa_gwdt_update_timer(SBSA_GWDTState *s, WdtRefreshType rtype)
     }
 
     timeout = (uint64_t)s->wcvu << 32 | s->wcvl;
+    /* clamp timeout to INT64_MAX to avoid timer overflow */
+    timeout &= INT64_MAX;
     timer_mod(s->timer, timeout);
 }
 
diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 94fc95c8e1..370b0fd2e6 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2308,7 +2308,7 @@ static void test_acpi_aarch64_virt_tcg_gtdt_wd(void)
         .scan_len = 128ULL * MiB,
     };
 
-    test_acpi_one("-cpu cortex-a57 " "-device sbsa-gwdt", &data);
+    test_acpi_one("-cpu cortex-a57 -device sbsa-gwdt", &data);
     free_test_data(&data);
 }
 
-- 
2.47.3