xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-24 03:59:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

target-mips: fix corner case in TLBWR causing QEMU to hang

Browse Source 
cpu_mips_get_random() function is used to generate a random index from
CP0.Wired to TLBSize-1 range. Current implementation avoids generating
the same as before value, hence the while loop. If the guest sets
CP0.Wired to TLBSize-1 (which actually does not sound to be very
practical) QEMU will get stuck in the loop infinitely as we always
generate the same index.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
This commit is contained in:
Leon Alrae 2015-09-10 10:15:28 +01:00
parent ceb0ee147d
commit 3adafef2f3
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hw/mips/cputimer.c
View File

@ -33,13 +33,18 @@ uint32_t cpu_mips_get_random (CPUMIPSState *env)
static uint32_t seed = 1;
static uint32_t prev_idx = 0;
uint32_t idx;
uint32_t nb_rand_tlb = env->tlb->nb_tlb - env->CP0_Wired;
if (nb_rand_tlb == 1) {
return env->tlb->nb_tlb - 1;
}
/* Don't return same value twice, so get another value */
do {
/* Use a simple algorithm of Linear Congruential Generator
* from ISO/IEC 9899 standard. */
seed = 1103515245 * seed + 12345;
idx = (seed >> 16) % (env->tlb->nb_tlb - env->CP0_Wired) +
env->CP0_Wired;
idx = (seed >> 16) % nb_rand_tlb + env->CP0_Wired;
} while (idx == prev_idx);
prev_idx = idx;
return idx;