Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging

MIPS patches queue

- Fix array overrun (Coverity CID 1450831)
- Deprecate KVM TE (Trap-and-Emul)

# gpg: Signature made Mon 22 Mar 2021 14:06:48 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd/tags/mips-fixes-20210322:
  target/mips: Deprecate Trap-and-Emul KVM support
  target/mips/mxu_translate.c: Fix array overrun for D16MIN/D16MAX

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

2 files changed, 13 insertions, 4 deletions

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 67c98dcaa0..80cae86252 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -186,6 +186,15 @@ Use the more generic commands ``block-export-add`` and ``block-export-del``
 instead.  As part of this deprecation, where ``nbd-server-add`` used a
 single ``bitmap``, the new ``block-export-add`` uses a list of ``bitmaps``.
 
+System accelerators
+-------------------
+
+MIPS ``Trap-and-Emul`` KVM support (since 6.0)
+''''''''''''''''''''''''''''''''''''''''''''''
+
+The MIPS ``Trap-and-Emul`` KVM host and guest support has been removed
+from Linux upstream kernel, declare it deprecated.
+
 System emulator CPUS
 --------------------
 
diff --git a/target/mips/mxu_translate.c b/target/mips/mxu_translate.c
index afc008eeee..fb0a811af6 100644
--- a/target/mips/mxu_translate.c
+++ b/target/mips/mxu_translate.c
@@ -1095,12 +1095,12 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
 
     if (unlikely(pad != 0)) {
         /* opcode padding incorrect -> do nothing */
-    } else if (unlikely(XRc == 0)) {
+    } else if (unlikely(XRa == 0)) {
         /* destination is zero register -> do nothing */
-    } else if (unlikely((XRb == 0) && (XRa == 0))) {
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
         /* both operands zero registers -> just set destination to zero */
-        tcg_gen_movi_i32(mxu_gpr[XRc - 1], 0);
-    } else if (unlikely((XRb == 0) || (XRa == 0))) {
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely((XRb == 0) || (XRc == 0))) {
         /* exactly one operand is zero register - find which one is not...*/
         uint32_t XRx = XRb ? XRb : XRc;
         /* ...and do half-word-wise max/min with one operand 0 */