aboutsummaryrefslogtreecommitdiff
path: root/hw/mips/cputimer.c
diff options
context:
space:
mode:
authorLeon Alrae <leon.alrae@imgtec.com>2015-09-10 10:15:28 +0100
committerLeon Alrae <leon.alrae@imgtec.com>2015-09-18 09:20:48 +0100
commit3adafef2f35d9061b56a09071b2589b9e0b36f76 (patch)
tree8e60b28acd33c2ac4ae59c6dab962bcfcdaa187b /hw/mips/cputimer.c
parentceb0ee147df35adc7b705da1c84a4624c9cabb21 (diff)
target-mips: fix corner case in TLBWR causing QEMU to hang
cpu_mips_get_random() function is used to generate a random index from CP0.Wired to TLBSize-1 range. Current implementation avoids generating the same as before value, hence the while loop. If the guest sets CP0.Wired to TLBSize-1 (which actually does not sound to be very practical) QEMU will get stuck in the loop infinitely as we always generate the same index. Signed-off-by: Leon Alrae <leon.alrae@imgtec.com> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'hw/mips/cputimer.c')
-rw-r--r--hw/mips/cputimer.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/hw/mips/cputimer.c b/hw/mips/cputimer.c
index 1603600118..ba9264b415 100644
--- a/hw/mips/cputimer.c
+++ b/hw/mips/cputimer.c
@@ -33,13 +33,18 @@ uint32_t cpu_mips_get_random (CPUMIPSState *env)
static uint32_t seed = 1;
static uint32_t prev_idx = 0;
uint32_t idx;
+ uint32_t nb_rand_tlb = env->tlb->nb_tlb - env->CP0_Wired;
+
+ if (nb_rand_tlb == 1) {
+ return env->tlb->nb_tlb - 1;
+ }
+
/* Don't return same value twice, so get another value */
do {
/* Use a simple algorithm of Linear Congruential Generator
* from ISO/IEC 9899 standard. */
seed = 1103515245 * seed + 12345;
- idx = (seed >> 16) % (env->tlb->nb_tlb - env->CP0_Wired) +
- env->CP0_Wired;
+ idx = (seed >> 16) % nb_rand_tlb + env->CP0_Wired;
} while (idx == prev_idx);
prev_idx = idx;
return idx;