From 20b42789aa4d2a4d292b1fc8590065f9d391d78d Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 16 Mar 2021 13:13:53 +0000 Subject: [PATCH 1/2] target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity reported (CID 1450831) an array overrun in gen_mxu_D16MAX_D16MIN(): 1103 } else if (unlikely((XRb == 0) || (XRa == 0))) { .... 1112 if (opc == OPC_MXU_D16MAX) { 1113 tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1); 1114 } else { 1115 tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1); 1116 } >>> Overrunning array "mxu_gpr" of 15 8-byte elements at element index 4294967295 (byte offset 34359738367) using index "XRa - 1U" (which evaluates to 4294967295). This happens because the code is confused about which of XRa, XRb and XRc is the output, and which are the inputs. XRa is the output, but most of the conditions separating out different special cases are written as if XRc is the output, with the result that we can end up in the code path that assumes XRa is non-0 even when it is zero. Fix the erroneous code, bringing it in to line with the structure used in functions like gen_mxu_S32MAX_S32MIN() and gen_mxu_Q8MAX_Q8MIN(). Fixes: CID 1450831 Fixes: bb84cbf38505bd1d8 Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20210316131353.4533-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- target/mips/mxu_translate.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/target/mips/mxu_translate.c b/target/mips/mxu_translate.c index afc008eeee..fb0a811af6 100644 --- a/target/mips/mxu_translate.c +++ b/target/mips/mxu_translate.c @@ -1095,12 +1095,12 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx) if (unlikely(pad != 0)) { /* opcode padding incorrect -> do nothing */ - } else if (unlikely(XRc == 0)) { + } else if (unlikely(XRa == 0)) { /* destination is zero register -> do nothing */ - } else if (unlikely((XRb == 0) && (XRa == 0))) { + } else if (unlikely((XRb == 0) && (XRc == 0))) { /* both operands zero registers -> just set destination to zero */ - tcg_gen_movi_i32(mxu_gpr[XRc - 1], 0); - } else if (unlikely((XRb == 0) || (XRa == 0))) { + tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0); + } else if (unlikely((XRb == 0) || (XRc == 0))) { /* exactly one operand is zero register - find which one is not...*/ uint32_t XRx = XRb ? XRb : XRc; /* ...and do half-word-wise max/min with one operand 0 */ From f071dc1f0ccc45e4ac4f538b7c273a0fdcfe1401 Mon Sep 17 00:00:00 2001 From: Jiaxun Yang Date: Wed, 17 Mar 2021 09:12:35 +0800 Subject: [PATCH 2/2] target/mips: Deprecate Trap-and-Emul KVM support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream kernel had removed both host[1] and guest[2] support. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=45c7e8af4a5e3f0bea4ac209eea34118dd57ac64 [2]: https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=a1515ec7204edca770c07929df8538fcdb03ad46 Signed-off-by: Jiaxun Yang Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20210317011235.7425-1-jiaxun.yang@flygoat.com> [PMD: Specify mentioned kernel is Linux] Signed-off-by: Philippe Mathieu-Daudé --- docs/system/deprecated.rst | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 67c98dcaa0..80cae86252 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -186,6 +186,15 @@ Use the more generic commands ``block-export-add`` and ``block-export-del`` instead. As part of this deprecation, where ``nbd-server-add`` used a single ``bitmap``, the new ``block-export-add`` uses a list of ``bitmaps``. +System accelerators +------------------- + +MIPS ``Trap-and-Emul`` KVM support (since 6.0) +'''''''''''''''''''''''''''''''''''''''''''''' + +The MIPS ``Trap-and-Emul`` KVM host and guest support has been removed +from Linux upstream kernel, declare it deprecated. + System emulator CPUS --------------------