diff options
author | Leon Alrae <leon.alrae@imgtec.com> | 2015-09-10 10:15:28 +0100 |
---|---|---|
committer | Leon Alrae <leon.alrae@imgtec.com> | 2015-09-18 09:20:48 +0100 |
commit | 3adafef2f35d9061b56a09071b2589b9e0b36f76 (patch) | |
tree | 8e60b28acd33c2ac4ae59c6dab962bcfcdaa187b /hw/mips/cputimer.c | |
parent | ceb0ee147df35adc7b705da1c84a4624c9cabb21 (diff) |
target-mips: fix corner case in TLBWR causing QEMU to hang
cpu_mips_get_random() function is used to generate a random index from
CP0.Wired to TLBSize-1 range. Current implementation avoids generating
the same as before value, hence the while loop. If the guest sets
CP0.Wired to TLBSize-1 (which actually does not sound to be very
practical) QEMU will get stuck in the loop infinitely as we always
generate the same index.
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'hw/mips/cputimer.c')
-rw-r--r-- | hw/mips/cputimer.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/hw/mips/cputimer.c b/hw/mips/cputimer.c index 1603600118..ba9264b415 100644 --- a/hw/mips/cputimer.c +++ b/hw/mips/cputimer.c @@ -33,13 +33,18 @@ uint32_t cpu_mips_get_random (CPUMIPSState *env) static uint32_t seed = 1; static uint32_t prev_idx = 0; uint32_t idx; + uint32_t nb_rand_tlb = env->tlb->nb_tlb - env->CP0_Wired; + + if (nb_rand_tlb == 1) { + return env->tlb->nb_tlb - 1; + } + /* Don't return same value twice, so get another value */ do { /* Use a simple algorithm of Linear Congruential Generator * from ISO/IEC 9899 standard. */ seed = 1103515245 * seed + 12345; - idx = (seed >> 16) % (env->tlb->nb_tlb - env->CP0_Wired) + - env->CP0_Wired; + idx = (seed >> 16) % nb_rand_tlb + env->CP0_Wired; } while (idx == prev_idx); prev_idx = idx; return idx; |