[PULL 0/2] MIPS patches for 2021-03-22

[PULL 0/2] MIPS patches for 2021-03-22

[Philippe Mathieu-Daudé]

The following changes since commit bdee969c0e65d4d509932b1d70e3a3b2ffbff6d5:

  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-19 18:01:17 +0000)

are available in the Git repository at:

  https://github.com/philmd/qemu.git tags/mips-fixes-20210322

for you to fetch changes up to 83bbc537a151730741c04e40d23711067330dab9:

  target/mips: Deprecate Trap-and-Emul KVM support (2021-03-22 11:28:04 +0100)

----------------------------------------------------------------
MIPS patches queue

- Fix array overrun (Coverity CID 1450831)
- Deprecate KVM TE (Trap-and-Emul)
----------------------------------------------------------------

Jiaxun Yang (1):
  target/mips: Deprecate Trap-and-Emul KVM support

Peter Maydell (1):
  target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX

 docs/system/deprecated.rst  | 9 +++++++++
 target/mips/mxu_translate.c | 8 ++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

-- 
2.26.2

[PULL 1/2] target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

Coverity reported (CID 1450831) an array overrun in
gen_mxu_D16MAX_D16MIN():

  1103     } else if (unlikely((XRb == 0) || (XRa == 0))) {
  ....
  1112         if (opc == OPC_MXU_D16MAX) {
  1113             tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1);
  1114         } else {
  1115             tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1);
  1116         }

>>> Overrunning array "mxu_gpr" of 15 8-byte elements at element
    index 4294967295 (byte offset 34359738367) using index "XRa - 1U"
    (which evaluates to 4294967295).

This happens because the code is confused about which of XRa, XRb and
XRc is the output, and which are the inputs.  XRa is the output, but
most of the conditions separating out different special cases are
written as if XRc is the output, with the result that we can end up
in the code path that assumes XRa is non-0 even when it is zero.

Fix the erroneous code, bringing it in to line with the structure
used in functions like gen_mxu_S32MAX_S32MIN() and
gen_mxu_Q8MAX_Q8MIN().

Fixes: CID 1450831
Fixes: bb84cbf38505bd1d8
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210316131353.4533-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 target/mips/mxu_translate.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/mips/mxu_translate.c b/target/mips/mxu_translate.c
index afc008eeeef..fb0a811af6c 100644
--- a/target/mips/mxu_translate.c
+++ b/target/mips/mxu_translate.c
@@ -1095,12 +1095,12 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
 
     if (unlikely(pad != 0)) {
         /* opcode padding incorrect -> do nothing */
-    } else if (unlikely(XRc == 0)) {
+    } else if (unlikely(XRa == 0)) {
         /* destination is zero register -> do nothing */
-    } else if (unlikely((XRb == 0) && (XRa == 0))) {
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_i32(mxu_gpr[XRc - 1], 0);
-    } else if (unlikely((XRb == 0) || (XRa == 0))) {
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely((XRb == 0) || (XRc == 0))) {
         /* exactly one operand is zero register - find which one is not...*/
         uint32_t XRx = XRb ? XRb : XRc;
         /* ...and do half-word-wise max/min with one operand 0 */
-- 
2.26.2

[PULL 2/2] target/mips: Deprecate Trap-and-Emul KVM support

[Philippe Mathieu-Daudé]

From: Jiaxun Yang <jiaxun.yang@flygoat.com>

Upstream kernel had removed both host[1] and guest[2] support.

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=45c7e8af4a5e3f0bea4ac209eea34118dd57ac64
[2]: https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=a1515ec7204edca770c07929df8538fcdb03ad46

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210317011235.7425-1-jiaxun.yang@flygoat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 docs/system/deprecated.rst | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 67c98dcaa0c..d3004acf948 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -186,6 +186,15 @@ Use the more generic commands ``block-export-add`` and ``block-export-del``
 instead.  As part of this deprecation, where ``nbd-server-add`` used a
 single ``bitmap``, the new ``block-export-add`` uses a list of ``bitmaps``.
 
+System accelerators
+-------------------
+
+MIPS ``Trap-and-Emul`` KVM support (since 6.0)
+''''''''''''''''''''''''''''''''''''''''''''''
+
+The MIPS ``Trap-and-Emul`` KVM host and guest support has been removed
+from upstream kernel, declare it deprecated.
+
 System emulator CPUS
 --------------------
 
-- 
2.26.2

Re: [PULL 0/2] MIPS patches for 2021-03-22

[Peter Maydell]

On Mon, 22 Mar 2021 at 14:22, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
>
> The following changes since commit bdee969c0e65d4d509932b1d70e3a3b2ffbff6d5:
>
>   Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-19 18:01:17 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/philmd/qemu.git tags/mips-fixes-20210322
>
> for you to fetch changes up to 83bbc537a151730741c04e40d23711067330dab9:
>
>   target/mips: Deprecate Trap-and-Emul KVM support (2021-03-22 11:28:04 +0100)
>
> ----------------------------------------------------------------
> MIPS patches queue
>
> - Fix array overrun (Coverity CID 1450831)
> - Deprecate KVM TE (Trap-and-Emul)
> ----------------------------------------------------------------
>
> Jiaxun Yang (1):
>   target/mips: Deprecate Trap-and-Emul KVM support
>
> Peter Maydell (1):
>   target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/6.0
for any user-visible changes.

-- PMM