aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-05-21update-linux-headers: handle new header fileCornelia Huck
We need to copy sve_context.h for aarch64. Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2019-05-17Merge tag 's390x-tcg-2019-05-17-2' into s390-next-stagingCornelia Huck
Implement all Vector Integer Instructions introduced with the "Vector Facility" for s390x TCG. # gpg: Signature made Fri 17 May 2019 01:37:40 PM CEST # gpg: using RSA key 4DDE10F700FF835A # gpg: Good signature from "David Hildenbrand <david@redhat.com>" [full] # gpg: aka "David Hildenbrand <davidhildenbrand@gmail.com>" [full] * tag 's390x-tcg-2019-05-17-2': (40 commits) s390x/tcg: Implement VECTOR TEST UNDER MASK s390x/tcg: Implement VECTOR SUM ACROSS WORD s390x/tcg: Implement VECTOR SUM ACROSS QUADWORD s390x/tcg: Implement VECTOR SUM ACROSS DOUBLEWORD s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW COMPUTE BORROW INDICATION s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW INDICATION s390x/tcg: Implement VECTOR SUBTRACT COMPUTE BORROW INDICATION s390x/tcg: Implement VECTOR SUBTRACT s390x/tcg: Implement VECTOR SHIFT RIGHT LOGICAL * s390x/tcg: Implement VECTOR SHIFT RIGHT ARITHMETIC s390x/tcg: Implement VECTOR SHIFT LEFT DOUBLE BY BYTE s390x/tcg: Implement VECTOR SHIFT LEFT (BY BYTE) s390x/tcg: Implement VECTOR ELEMENT SHIFT s390x/tcg: Implement VECTOR ELEMENT ROTATE AND INSERT UNDER MASK s390x/tcg: Implement VECTOR ELEMENT ROTATE LEFT LOGICAL s390x/tcg: Implement VECTOR POPULATION COUNT s390x/tcg: Implement VECTOR OR WITH COMPLEMENT s390x/tcg: Implement VECTOR OR s390x/tcg: Implement VECTOR NOT EXCLUSIVE OR s390x/tcg: Implement VECTOR NOR ... Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR TEST UNDER MASKDavid Hildenbrand
Let's return the cc value directly via cpu_env. Unfortunately there isn't a simple way to calculate the value lazily - one would have to calculate and store e.g. the population count of the mask and the result so it can be evaluated in a cc helper. But as VTM only sets the cc, we can assume the value will be needed soon either way. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUM ACROSS WORDDavid Hildenbrand
Similar to VECTOR SUM ACROSS DOUBLEWORD. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUM ACROSS QUADWORDDavid Hildenbrand
Similar to VECTOR SUM ACROSS DOUBLEWORD, however without a loop and using 128-bit calculations. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUM ACROSS DOUBLEWORDDavid Hildenbrand
Perform the calculations without a helper. Only 16 bit or 32 bit values have to be added. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW COMPUTE BORROW INDICATIONDavid Hildenbrand
Mostly courtesy of Richard H. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW INDICATIONDavid Hildenbrand
Fairly easy as only 128-bit handling is required. Simply perform the subtraction and then subtract the borrow. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUBTRACT COMPUTE BORROW INDICATIONDavid Hildenbrand
Let's keep it simple for now and handle 8/16 bit elements via helpers. Especially for 8/16, we could come up with some bit tricks. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SUBTRACTDavid Hildenbrand
We can use tcg_gen_sub2_i64() to do 128-bit subtraction and otherwise existing gvec helpers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SHIFT RIGHT LOGICAL *David Hildenbrand
Similar to VECTOR SHIFT RIGHT ARITHMETICAL. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SHIFT RIGHT ARITHMETICDavid Hildenbrand
Similar to VECTOR SHIFT LEFT ARITHMETIC. Add s390_vec_sar() similar to s390_vec_shr(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SHIFT LEFT DOUBLE BY BYTEDavid Hildenbrand
Inline expansion courtesy of Richard H. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR SHIFT LEFT (BY BYTE)David Hildenbrand
We can reuse the existing 128-bit shift utility function. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ELEMENT SHIFTDavid Hildenbrand
We can use all the fancy new vector helpers implemented by Richard. One important thing to take care of is always to properly mask of unused bits from the shift count. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ELEMENT ROTATE AND INSERT UNDER MASKDavid Hildenbrand
Use the new vector expansion for GVecGen3i. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ELEMENT ROTATE LEFT LOGICALDavid Hildenbrand
Take care of properly taking the modulo of the count. We might later want to come back and create a variant of VERLL where the base register is 0, resulting in an immediate. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR POPULATION COUNTDavid Hildenbrand
Similar to VECTOR COUNT TRAILING ZEROES. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR OR WITH COMPLEMENTDavid Hildenbrand
Again, vector enhancements facility 1 material. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ORDavid Hildenbrand
Reuse a gvec helper. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR NOT EXCLUSIVE ORDavid Hildenbrand
Again, part of vector enhancement facility 1. The operation corresponds to an bitwise equality check. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR NORDavid Hildenbrand
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR NANDDavid Hildenbrand
Part of vector enhancements facility 1, but easy to implement. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR MULTIPLY *David Hildenbrand
Yet another set of variants. Implement it similar to VECTOR MULTIPLY AND ADD *. At least for one variant we have a gvec helper we can reuse. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR MULTIPLY AND ADD *David Hildenbrand
Quite some variants to handle. At least handle some 32-bit element variants via gvec expansion (we could also handle 16/32-bit variants for ODD and EVEN easily via gvec expansion, but let's keep it simple for now). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR (MAXIMUM|MINIMUM) (LOGICAL)David Hildenbrand
Luckily, we already have gvec helpers for all four cases. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR LOAD POSITIVEDavid Hildenbrand
Similar to VECTOR LOAD COMPLEMENT. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR LOAD COMPLEMENTDavid Hildenbrand
We can reuse an existing gvec helper for negating the values. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR GALOIS FIELD MULTIPLY SUM (AND ACCUMULATE)David Hildenbrand
A galois field multiplication in field 2 is like binary multiplication, however instead of doing ordinary binary additions, xor's are performed. So no carries are considered. Implement all variants via helpers. s390_vec_sar() and s390_vec_shr() will be reused later on. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR EXCLUSIVE ORDavid Hildenbrand
Easy, we can reuse an existing gvec helper. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR COUNT TRAILING ZEROSDavid Hildenbrand
Implement it similar to VECTOR COUNT LEADING ZEROS. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR COUNT LEADING ZEROSDavid Hildenbrand
For 8/16, use the 32 bit variant and properly subtract the added leading zero bits. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR COMPARE *David Hildenbrand
To carry out the comparison, we can reuse the existing gvec comparison function. In case the CC is to be computed, save the result vector and compute the CC lazily. The result is a vector consisting of all 1's for elements that matched and 0's for elements that didn't match. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ELEMENT COMPARE *David Hildenbrand
Fairly easy to implement, we can make use of the existing CC helpers cmps64 and cmpu64 - we siply have to sign extend the elements. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR CHECKSUMDavid Hildenbrand
Time to introduce read_vec_element_i32 and write_vec_element_i32. Take proper care of properly adding the carry. We can perform both additions including the carry via tcg_gen_add2_i32(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR AVERAGE LOGICALDavid Hildenbrand
Similar to VECTOR AVERAGE but without sign extension. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR AVERAGEDavid Hildenbrand
Handle 32/64-bit elements via gvec expansion and the 8/16 bits via ool helpers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR AND (WITH COMPLEMENT)David Hildenbrand
Easy, as we can reuse existing gvec helpers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ADD WITH CARRY COMPUTE CARRYDavid Hildenbrand
Similar to VECTOR ADD COMPUTE CARRY, however 128-bit handling only. Courtesy of Richard H. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ADD WITH CARRYDavid Hildenbrand
Only slightly ugly, perform two additions. At least it is only supported for 128 bit elements. Introduce gen_gvec128_4_i64() similar to gen_gvec128_3_i64(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ADD COMPUTE CARRYDavid Hildenbrand
128-bit handling courtesy of Richard H. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390x/tcg: Implement VECTOR ADDDavid Hildenbrand
Introduce two types of fancy new helpers that will be reused a couple of times 1. gen_gvec_fn_3: Call an existing tcg_gen_gvec_X function with 3 parameters, simplifying parameter passing 2. gen_gvec128_3_i64: Call a function that performs 128 bit calculations using two 64 bit values per vector. Luckily, for VECTOR ADD we already have everything we need. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Hildenbrand <david@redhat.com>
2019-05-17s390/css: handle CCW_FLAG_SKIPCornelia Huck
If a ccw has CCW_FLAG_SKIP set, and the command is of type read, read backwards, or sense, no data should be written to the guest for that command. Reviewed-by: Eric Farman <farman@linux.ibm.com> Message-Id: <20190516133327.11430-1-cohuck@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2019-05-17Merge tag 's390-ccw-bios-2019-05-08' into s390-next-stagingCornelia Huck
Skip unsupported bootmap signature entries instead of aborting the boot process # gpg: Signature made Wed 08 May 2019 11:42:24 AM CEST # gpg: using RSA key 2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [undefined] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [undefined] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] * tag 's390-ccw-bios-2019-05-08': pc-bios/s390: Update firmware image with "Skip bootmap signature entries" fix s390-bios: Skip bootmap signature entries pc-bios/s390-ccw: Clean up harmless misuse of isdigit()
2019-05-17s390/ipl: cast to SCSIDevice directlyCornelia Huck
Coverity notes that the result of object_dynamic_cast() to SCSIDevice is not checked in s390_gen_initial_iplp(); as we know that we always have a SCSIDevice in that branch, we can instead cast via SCSI_DEVICE directly. Coverity: CID 1401098 Fixes: 44445d8668f4 ("s390 vfio-ccw: Add bootindex property and IPLB data") Message-Id: <20190502155516.12415-1-cohuck@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2019-05-16Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190510' into stagingPeter Maydell
Add CPUClass::tlb_fill. Improve tlb_vaddr_to_host for use by ARM SVE no-fault loads. # gpg: Signature made Fri 10 May 2019 19:48:37 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20190510: (27 commits) tcg: Use tlb_fill probe from tlb_vaddr_to_host tcg: Remove CPUClass::handle_mmu_fault tcg: Use CPUClass::tlb_fill in cputlb.c target/xtensa: Convert to CPUClass::tlb_fill target/unicore32: Convert to CPUClass::tlb_fill target/tricore: Convert to CPUClass::tlb_fill target/tilegx: Convert to CPUClass::tlb_fill target/sparc: Convert to CPUClass::tlb_fill target/sh4: Convert to CPUClass::tlb_fill target/s390x: Convert to CPUClass::tlb_fill target/riscv: Convert to CPUClass::tlb_fill target/ppc: Convert to CPUClass::tlb_fill target/openrisc: Convert to CPUClass::tlb_fill target/nios2: Convert to CPUClass::tlb_fill target/moxie: Convert to CPUClass::tlb_fill target/mips: Convert to CPUClass::tlb_fill target/mips: Tidy control flow in mips_cpu_handle_mmu_fault target/mips: Pass a valid error to raise_mmu_exception for user-only target/microblaze: Convert to CPUClass::tlb_fill target/m68k: Convert to CPUClass::tlb_fill ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-16Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert/tags/pull-migration-20190514b' into staging Migration pull 2019-05-14 Small fixes/cleanups One HMP/monitor fix # gpg: Signature made Tue 14 May 2019 19:03:53 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20190514b: monitor: Call mon_get_cpu() only once at hmp_gva2gpa() migration/ram.c: fix typos in comments migration: Fix use-after-free during process exit migration/savevm: wrap into qemu_loadvm_state_header() migration/savevm: load_header before load_setup migration/savevm: remove duplicate check of migration_is_blocked migration: update comments of migration bitmap migration/ram.c: start of migration_bitmap_sync_range is always 0 qemu-option.hx: Update missed parameter for colo-compare migration/colo.h: Remove obsolete codes migration/colo.c: Remove redundant input parameter migration: savevm: fix error code with migration blockers vmstate: check subsection_found is enough migration: remove not used field xfer_limit migration: not necessary to check ops again migration: comment VMSTATE_UNUSED*() properly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-14monitor: Call mon_get_cpu() only once at hmp_gva2gpa()Eduardo Habkost
hmp_gva2gpa() calls mon_get_cpu() twice, which is unnecessary. Not an actual bug, but this is reported as a defect by Coverity Scan (CID 1401346). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190510185620.15757-1-ehabkost@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/ram.c: fix typos in commentsWei Yang
Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190510233729.15554-1-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: Fix use-after-free during process exitYury Kotov
It fixes heap-use-after-free which was found by clang's ASAN. Control flow of this use-after-free: main_thread: * Got SIGTERM and completes main loop * Calls migration_shutdown - migrate_fd_cancel (so, migration_thread begins to complete) - object_unref(OBJECT(current_migration)); migration_thread: * migration_iteration_finish -> schedule cleanup bh * object_unref(OBJECT(s)); (Now, current_migration is freed) * exits main_thread: * Calls vm_shutdown -> drain bdrvs -> main loop -> cleanup_bh -> use after free If you want to reproduce, these couple of sleeps will help: vl.c:4613: migration_shutdown(); + sleep(2); migration.c:3269: + sleep(1); trace_migration_thread_after_loop(); migration_iteration_finish(s); Original output: qemu-system-x86_64: terminating on signal 15 from pid 31980 (<unknown process>) ================================================================= ==31958==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900001d210 at pc 0x555558a535ca bp 0x7fffffffb190 sp 0x7fffffffb188 READ of size 8 at 0x61900001d210 thread T0 (qemu-vm-0) #0 0x555558a535c9 in migrate_fd_cleanup migration/migration.c:1502:23 #1 0x5555594fde0a in aio_bh_call util/async.c:90:5 #2 0x5555594fe522 in aio_bh_poll util/async.c:118:13 #3 0x555559524783 in aio_poll util/aio-posix.c:725:17 #4 0x555559504fb3 in aio_wait_bh_oneshot util/aio-wait.c:71:5 #5 0x5555573bddf6 in virtio_blk_data_plane_stop hw/block/dataplane/virtio-blk.c:282:5 #6 0x5555589d5c09 in virtio_bus_stop_ioeventfd hw/virtio/virtio-bus.c:246:9 #7 0x5555589e9917 in virtio_pci_stop_ioeventfd hw/virtio/virtio-pci.c:287:5 #8 0x5555589e22bf in virtio_pci_vmstate_change hw/virtio/virtio-pci.c:1072:9 #9 0x555557628931 in virtio_vmstate_change hw/virtio/virtio.c:2257:9 #10 0x555557c36713 in vm_state_notify vl.c:1605:9 #11 0x55555716ef53 in do_vm_stop cpus.c:1074:9 #12 0x55555716eeff in vm_shutdown cpus.c:1092:12 #13 0x555557c4283e in main vl.c:4617:5 #14 0x7fffdfdb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #15 0x555556ecb118 in _start (x86_64-softmmu/qemu-system-x86_64+0x1977118) 0x61900001d210 is located 144 bytes inside of 952-byte region [0x61900001d180,0x61900001d538) freed by thread T6 (live_migration) here: #0 0x555556f76782 in __interceptor_free /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3 #1 0x555558d5fa94 in object_finalize qom/object.c:618:9 #2 0x555558d57651 in object_unref qom/object.c:1068:9 #3 0x555558a55588 in migration_thread migration/migration.c:3272:5 #4 0x5555595393f2 in qemu_thread_start util/qemu-thread-posix.c:502:9 #5 0x7fffe057f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) previously allocated by thread T0 (qemu-vm-0) here: #0 0x555556f76b03 in __interceptor_malloc /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3 #1 0x7ffff6ee37b8 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f7b8) #2 0x555558d58031 in object_new qom/object.c:640:12 #3 0x555558a31f21 in migration_object_init migration/migration.c:139:25 #4 0x555557c41398 in main vl.c:4320:5 #5 0x7fffdfdb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) Thread T6 (live_migration) created by T0 (qemu-vm-0) here: #0 0x555556f5f0dd in pthread_create /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3 #1 0x555559538cf9 in qemu_thread_create util/qemu-thread-posix.c:539:11 #2 0x555558a53304 in migrate_fd_connect migration/migration.c:3332:5 #3 0x555558a72bd8 in migration_channel_connect migration/channel.c:92:5 #4 0x555558a6ef87 in exec_start_outgoing_migration migration/exec.c:42:5 #5 0x555558a4f3c2 in qmp_migrate migration/migration.c:1922:9 #6 0x555558bb4f6a in qmp_marshal_migrate qapi/qapi-commands-migration.c:607:5 #7 0x555559363738 in do_qmp_dispatch qapi/qmp-dispatch.c:131:5 #8 0x555559362a15 in qmp_dispatch qapi/qmp-dispatch.c:174:11 #9 0x5555571bac15 in monitor_qmp_dispatch monitor.c:4124:11 #10 0x55555719a22d in monitor_qmp_bh_dispatcher monitor.c:4207:9 #11 0x5555594fde0a in aio_bh_call util/async.c:90:5 #12 0x5555594fe522 in aio_bh_poll util/async.c:118:13 #13 0x5555595201e0 in aio_dispatch util/aio-posix.c:460:5 #14 0x555559503553 in aio_ctx_dispatch util/async.c:261:5 #15 0x7ffff6ede196 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a196) SUMMARY: AddressSanitizer: heap-use-after-free migration/migration.c:1502:23 in migrate_fd_cleanup Shadow bytes around the buggy address: 0x0c327fffb9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c327fffba40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==31958==ABORTING Signed-off-by: Yury Kotov <yury-kotov@yandex-team.ru> Message-Id: <20190408113343.2370-1-yury-kotov@yandex-team.ru> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixed up comment formatting