target/tilegx: avoid integer overflow in next_page PC check
If the PC is in the last page of the address space, next_page_start overflows to 0. Fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This commit is contained in:
parent
818c187781
commit
5c433a7aac
|
@ -2375,7 +2375,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
|
||||||
DisasContext ctx;
|
DisasContext ctx;
|
||||||
DisasContext *dc = &ctx;
|
DisasContext *dc = &ctx;
|
||||||
uint64_t pc_start = tb->pc;
|
uint64_t pc_start = tb->pc;
|
||||||
uint64_t next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
|
uint64_t page_start = pc_start & TARGET_PAGE_MASK;
|
||||||
int num_insns = 0;
|
int num_insns = 0;
|
||||||
int max_insns = tb_cflags(tb) & CF_COUNT_MASK;
|
int max_insns = tb_cflags(tb) & CF_COUNT_MASK;
|
||||||
|
|
||||||
|
@ -2415,7 +2415,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
|
||||||
}
|
}
|
||||||
dc->pc += TILEGX_BUNDLE_SIZE_IN_BYTES;
|
dc->pc += TILEGX_BUNDLE_SIZE_IN_BYTES;
|
||||||
if (num_insns >= max_insns
|
if (num_insns >= max_insns
|
||||||
|| dc->pc >= next_page_start
|
|| (dc->pc - page_start >= TARGET_PAGE_SIZE)
|
||||||
|| tcg_op_buf_full()) {
|
|| tcg_op_buf_full()) {
|
||||||
/* Ending the TB due to TB size or page boundary. Set PC. */
|
/* Ending the TB due to TB size or page boundary. Set PC. */
|
||||||
tcg_gen_movi_tl(cpu_pc, dc->pc);
|
tcg_gen_movi_tl(cpu_pc, dc->pc);
|
||||||
|
|
Loading…
Reference in New Issue