s390x/cpumodel: wire up 8561 and 8562 as gen15 machines

8561 and 8562 will be gen15 machines. There is no name yet, let us use
gen15a and gen15b as base name. Later on we can provide aliases with
the proper name.

Signed-off-by: Christian Borntraeger <[email protected]>
Message-Id: <20190429090250[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: add gen15 defintions

add several new features (msa9, sort, deflate, additional vector
instructions, new general purpose instructions) to generation 15.

Also disable csske and bpb from the default and base models >=15.
This will allow to migrate gen15 machines to future machines that
do not have these features.

Signed-off-by: Christian Borntraeger <[email protected]>
Message-Id: <20190429090250[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: add Deflate-conversion facility

add the deflate conversion facility.

Signed-off-by: Christian Borntraeger <[email protected]>
Message-Id: <20190429090250[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: enhanced sort facility

add the enhanced sort facility.

Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Message-Id: <20190429090250[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: vector enhancements

Add vector enhancements to the cpu model.

Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Message-Id: <20190429090250[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: msa9 facility

Provide the MSA9 facility (stfle.155). This also contains pckmo
subfunctions for key wrapping. Keep them in a separate group to disable
those as a block if necessary. This is for example needed when disabling
key wrapping via the HMC.

Signed-off-by: Christian Borntraeger <[email protected]>
Message-Id: <20190429090250[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: Miscellaneous-Instruction-Extensions Facility 3

Provide the "Miscellaneous-Instruction-Extensions Facility 3" via
stfle.61.

Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Message-Id: <20190429090250[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

s390x/cpumodel: ignore csske for expansion

csske will be removed in a future machine. Ignore it for expanding the
cpu model. Otherwise qemu falls back to z9.

Signed-off-by: Christian Borntraeger <[email protected]>
Cc: [email protected]
Reviewed-by: David Hildenbrand <[email protected]>
Message-Id: <20190429090250[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

linux headers: update against Linux 5.2-rc1

commit a188339ca5a396acc588e5851ed7e19f66b0ebd9

Signed-off-by: Cornelia Huck <[email protected]>

update-linux-headers: handle new header file

We need to copy sve_context.h for aarch64.

Signed-off-by: Cornelia Huck <[email protected]>

Merge tag 's390x-tcg-2019-05-17-2' into s390-next-staging

Implement all Vector Integer Instructions introduced with the
"Vector Facility" for s390x TCG.

# gpg: Signature made Fri 17 May 2019 01:37:40 PM CEST
# gpg:                using RSA key 4DDE10F700FF835A
# gpg: Good signature from "David Hildenbrand <[email protected]>" [full]
# gpg:                 aka "David Hildenbrand <[email protected]>" [full]

* tag 's390x-tcg-2019-05-17-2': (40 commits)
  s390x/tcg: Implement VECTOR TEST UNDER MASK
  s390x/tcg: Implement VECTOR SUM ACROSS WORD
  s390x/tcg: Implement VECTOR SUM ACROSS QUADWORD
  s390x/tcg: Implement VECTOR SUM ACROSS DOUBLEWORD
  s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW COMPUTE BORROW INDICATION
  s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW INDICATION
  s390x/tcg: Implement VECTOR SUBTRACT COMPUTE BORROW INDICATION
  s390x/tcg: Implement VECTOR SUBTRACT
  s390x/tcg: Implement VECTOR SHIFT RIGHT LOGICAL *
  s390x/tcg: Implement VECTOR SHIFT RIGHT ARITHMETIC
  s390x/tcg: Implement VECTOR SHIFT LEFT DOUBLE BY BYTE
  s390x/tcg: Implement VECTOR SHIFT LEFT (BY BYTE)
  s390x/tcg: Implement VECTOR ELEMENT SHIFT
  s390x/tcg: Implement VECTOR ELEMENT ROTATE AND INSERT UNDER MASK
  s390x/tcg: Implement VECTOR ELEMENT ROTATE LEFT LOGICAL
  s390x/tcg: Implement VECTOR POPULATION COUNT
  s390x/tcg: Implement VECTOR OR WITH COMPLEMENT
  s390x/tcg: Implement VECTOR OR
  s390x/tcg: Implement VECTOR NOT EXCLUSIVE OR
  s390x/tcg: Implement VECTOR NOR
  ...

Signed-off-by: Cornelia Huck <[email protected]>

s390x/tcg: Implement VECTOR TEST UNDER MASK

Let's return the cc value directly via cpu_env. Unfortunately there
isn't a simple way to calculate the value lazily - one would have to
calculate and store e.g. the population count of the mask and the
result so it can be evaluated in a cc helper.

But as VTM only sets the cc, we can assume the value will be needed soon
either way.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUM ACROSS WORD

Similar to VECTOR SUM ACROSS DOUBLEWORD.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUM ACROSS QUADWORD

Similar to VECTOR SUM ACROSS DOUBLEWORD, however without a loop and
using 128-bit calculations.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUM ACROSS DOUBLEWORD

Perform the calculations without a helper. Only 16 bit or 32 bit values
have to be added.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW COMPUTE BORROW INDICATION

Mostly courtesy of Richard H.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUBTRACT WITH BORROW INDICATION

Fairly easy as only 128-bit handling is required. Simply perform the
subtraction and then subtract the borrow.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUBTRACT COMPUTE BORROW INDICATION

Let's keep it simple for now and handle 8/16 bit elements via helpers.
Especially for 8/16, we could come up with some bit tricks.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SUBTRACT

We can use tcg_gen_sub2_i64() to do 128-bit subtraction and otherwise
existing gvec helpers.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SHIFT RIGHT LOGICAL *

Similar to VECTOR SHIFT RIGHT ARITHMETICAL.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SHIFT RIGHT ARITHMETIC

Similar to VECTOR SHIFT LEFT ARITHMETIC. Add s390_vec_sar() similar to
s390_vec_shr().

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SHIFT LEFT DOUBLE BY BYTE

Inline expansion courtesy of Richard H.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR SHIFT LEFT (BY BYTE)

We can reuse the existing 128-bit shift utility function.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ELEMENT SHIFT

We can use all the fancy new vector helpers implemented by Richard.

One important thing to take care of is always to properly mask of
unused bits from the shift count.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ELEMENT ROTATE AND INSERT UNDER MASK

Use the new vector expansion for GVecGen3i.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ELEMENT ROTATE LEFT LOGICAL

Take care of properly taking the modulo of the count. We might later
want to come back and create a variant of VERLL where the base register
is 0, resulting in an immediate.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR POPULATION COUNT

Similar to VECTOR COUNT TRAILING ZEROES.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR OR WITH COMPLEMENT

Again, vector enhancements facility 1 material.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR OR

Reuse a gvec helper.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR NOT EXCLUSIVE OR

Again, part of vector enhancement facility 1. The operation corresponds
to an bitwise equality check.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR NOR

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR NAND

Part of vector enhancements facility 1, but easy to implement.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR MULTIPLY *

Yet another set of variants. Implement it similar to VECTOR MULTIPLY AND
ADD *. At least for one variant we have a gvec helper we can reuse.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR MULTIPLY AND ADD *

Quite some variants to handle. At least handle some 32-bit element
variants via gvec expansion (we could also handle 16/32-bit variants
for ODD and EVEN easily via gvec expansion, but let's keep it simple
for now).

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR (MAXIMUM|MINIMUM) (LOGICAL)

Luckily, we already have gvec helpers for all four cases.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR LOAD POSITIVE

Similar to VECTOR LOAD COMPLEMENT.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR LOAD COMPLEMENT

We can reuse an existing gvec helper for negating the values.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR GALOIS FIELD MULTIPLY SUM (AND ACCUMULATE)

A galois field multiplication in field 2 is like binary multiplication,
however instead of doing ordinary binary additions, xor's are performed.
So no carries are considered.

Implement all variants via helpers. s390_vec_sar() and s390_vec_shr()
will be reused later on.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR EXCLUSIVE OR

Easy, we can reuse an existing gvec helper.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR COUNT TRAILING ZEROS

Implement it similar to VECTOR COUNT LEADING ZEROS.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR COUNT LEADING ZEROS

For 8/16, use the 32 bit variant and properly subtract the added
leading zero bits.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR COMPARE *

To carry out the comparison, we can reuse the existing gvec comparison
function. In case the CC is to be computed, save the result vector
and compute the CC lazily. The result is a vector consisting of all 1's
for elements that matched and 0's for elements that didn't match.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ELEMENT COMPARE *

Fairly easy to implement, we can make use of the existing CC helpers
cmps64 and cmpu64 - we siply have to sign extend the elements.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR CHECKSUM

Time to introduce read_vec_element_i32 and write_vec_element_i32.
Take proper care of properly adding the carry. We can perform both
additions including the carry via tcg_gen_add2_i32().

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR AVERAGE LOGICAL

Similar to VECTOR AVERAGE but without sign extension.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR AVERAGE

Handle 32/64-bit elements via gvec expansion and the 8/16 bits via
ool helpers.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR AND (WITH COMPLEMENT)

Easy, as we can reuse existing gvec helpers.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ADD WITH CARRY COMPUTE CARRY

Similar to VECTOR ADD COMPUTE CARRY, however 128-bit handling only.
Courtesy of Richard H.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ADD WITH CARRY

Only slightly ugly, perform two additions. At least it is only supported
for 128 bit elements.

Introduce gen_gvec128_4_i64() similar to gen_gvec128_3_i64().

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ADD COMPUTE CARRY

128-bit handling courtesy of Richard H.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390x/tcg: Implement VECTOR ADD

Introduce two types of fancy new helpers that will be reused a couple of
times

1. gen_gvec_fn_3: Call an existing tcg_gen_gvec_X function with 3
   parameters, simplifying parameter passing
2. gen_gvec128_3_i64: Call a function that performs 128 bit calculations
   using two 64 bit values per vector.

Luckily, for VECTOR ADD we already have everything we need.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Hildenbrand <[email protected]>

s390/css: handle CCW_FLAG_SKIP

If a ccw has CCW_FLAG_SKIP set, and the command is of type
read, read backwards, or sense, no data should be written
to the guest for that command.

Reviewed-by: Eric Farman <[email protected]>
Message-Id: <20190516133327[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

Merge tag 's390-ccw-bios-2019-05-08' into s390-next-staging

Skip unsupported bootmap signature entries instead of aborting the boot process

# gpg: Signature made Wed 08 May 2019 11:42:24 AM CEST
# gpg:                using RSA key 2ED9D774FE702DB5
# gpg: Good signature from "Thomas Huth <[email protected]>" [full]
# gpg:                 aka "Thomas Huth <[email protected]>" [undefined]
# gpg:                 aka "Thomas Huth <[email protected]>" [undefined]
# gpg:                 aka "Thomas Huth <[email protected]>" [unknown]

* tag 's390-ccw-bios-2019-05-08':
  pc-bios/s390: Update firmware image with "Skip bootmap signature entries" fix
  s390-bios: Skip bootmap signature entries
  pc-bios/s390-ccw: Clean up harmless misuse of isdigit()

s390/ipl: cast to SCSIDevice directly

Coverity notes that the result of object_dynamic_cast() to
SCSIDevice is not checked in s390_gen_initial_iplp(); as
we know that we always have a SCSIDevice in that branch,
we can instead cast via SCSI_DEVICE directly.

Coverity: CID 1401098
Fixes: 44445d8668f4 ("s390 vfio-ccw: Add bootindex property and IPLB data")
Message-Id: <20190502155516[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Christian Borntraeger <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190510' into staging

Add CPUClass::tlb_fill.
Improve tlb_vaddr_to_host for use by ARM SVE no-fault loads.

# gpg: Signature made Fri 10 May 2019 19:48:37 BST
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "[email protected]"
# gpg: Good signature from "Richard Henderson <[email protected]>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20190510: (27 commits)
  tcg: Use tlb_fill probe from tlb_vaddr_to_host
  tcg: Remove CPUClass::handle_mmu_fault
  tcg: Use CPUClass::tlb_fill in cputlb.c
  target/xtensa: Convert to CPUClass::tlb_fill
  target/unicore32: Convert to CPUClass::tlb_fill
  target/tricore: Convert to CPUClass::tlb_fill
  target/tilegx: Convert to CPUClass::tlb_fill
  target/sparc: Convert to CPUClass::tlb_fill
  target/sh4: Convert to CPUClass::tlb_fill
  target/s390x: Convert to CPUClass::tlb_fill
  target/riscv: Convert to CPUClass::tlb_fill
  target/ppc: Convert to CPUClass::tlb_fill
  target/openrisc: Convert to CPUClass::tlb_fill
  target/nios2: Convert to CPUClass::tlb_fill
  target/moxie: Convert to CPUClass::tlb_fill
  target/mips: Convert to CPUClass::tlb_fill
  target/mips: Tidy control flow in mips_cpu_handle_mmu_fault
  target/mips: Pass a valid error to raise_mmu_exception for user-only
  target/microblaze: Convert to CPUClass::tlb_fill
  target/m68k: Convert to CPUClass::tlb_fill
  ...

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190514b' into staging

Migration pull 2019-05-14

Small fixes/cleanups
One HMP/monitor fix

# gpg: Signature made Tue 14 May 2019 19:03:53 BST
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <[email protected]>" [full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20190514b:
  monitor: Call mon_get_cpu() only once at hmp_gva2gpa()
  migration/ram.c: fix typos in comments
  migration: Fix use-after-free during process exit
  migration/savevm: wrap into qemu_loadvm_state_header()
  migration/savevm: load_header before load_setup
  migration/savevm: remove duplicate check of migration_is_blocked
  migration: update comments of migration bitmap
  migration/ram.c: start of migration_bitmap_sync_range is always 0
  qemu-option.hx: Update missed parameter for colo-compare
  migration/colo.h: Remove obsolete codes
  migration/colo.c: Remove redundant input parameter
  migration: savevm: fix error code with migration blockers
  vmstate: check subsection_found is enough
  migration: remove not used field xfer_limit
  migration: not necessary to check ops again
  migration: comment VMSTATE_UNUSED*() properly

Signed-off-by: Peter Maydell <[email protected]>

monitor: Call mon_get_cpu() only once at hmp_gva2gpa()

hmp_gva2gpa() calls mon_get_cpu() twice, which is unnecessary.
Not an actual bug, but this is reported as a defect by Coverity
Scan (CID 1401346).

Signed-off-by: Eduardo Habkost <[email protected]>
Message-Id: <20190510185620[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration/ram.c: fix typos in comments

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190510233729[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration: Fix use-after-free during process exit

It fixes heap-use-after-free which was found by clang's ASAN.

Control flow of this use-after-free:
main_thread:
    * Got SIGTERM and completes main loop
    * Calls migration_shutdown
      - migrate_fd_cancel (so, migration_thread begins to complete)
      - object_unref(OBJECT(current_migration));

migration_thread:
    * migration_iteration_finish -> schedule cleanup bh
    * object_unref(OBJECT(s)); (Now, current_migration is freed)
    * exits

main_thread:
    * Calls vm_shutdown -> drain bdrvs -> main loop
      -> cleanup_bh -> use after free

If you want to reproduce, these couple of sleeps will help:
vl.c:4613:
     migration_shutdown();
+    sleep(2);
migration.c:3269:
+    sleep(1);
     trace_migration_thread_after_loop();
     migration_iteration_finish(s);

Original output:
qemu-system-x86_64: terminating on signal 15 from pid 31980 (<unknown process>)
=================================================================
==31958==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900001d210
  at pc 0x555558a535ca bp 0x7fffffffb190 sp 0x7fffffffb188
READ of size 8 at 0x61900001d210 thread T0 (qemu-vm-0)
    #0 0x555558a535c9 in migrate_fd_cleanup migration/migration.c:1502:23
    #1 0x5555594fde0a in aio_bh_call util/async.c:90:5
    #2 0x5555594fe522 in aio_bh_poll util/async.c:118:13
    #3 0x555559524783 in aio_poll util/aio-posix.c:725:17
    #4 0x555559504fb3 in aio_wait_bh_oneshot util/aio-wait.c:71:5
    #5 0x5555573bddf6 in virtio_blk_data_plane_stop
      hw/block/dataplane/virtio-blk.c:282:5
    #6 0x5555589d5c09 in virtio_bus_stop_ioeventfd hw/virtio/virtio-bus.c:246:9
    #7 0x5555589e9917 in virtio_pci_stop_ioeventfd hw/virtio/virtio-pci.c:287:5
    #8 0x5555589e22bf in virtio_pci_vmstate_change hw/virtio/virtio-pci.c:1072:9
    #9 0x555557628931 in virtio_vmstate_change hw/virtio/virtio.c:2257:9
    #10 0x555557c36713 in vm_state_notify vl.c:1605:9
    #11 0x55555716ef53 in do_vm_stop cpus.c:1074:9
    #12 0x55555716eeff in vm_shutdown cpus.c:1092:12
    #13 0x555557c4283e in main vl.c:4617:5
    #14 0x7fffdfdb482f in __libc_start_main
      (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #15 0x555556ecb118 in _start (x86_64-softmmu/qemu-system-x86_64+0x1977118)

0x61900001d210 is located 144 bytes inside of 952-byte region
  [0x61900001d180,0x61900001d538)
freed by thread T6 (live_migration) here:
    #0 0x555556f76782 in __interceptor_free
      /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
    #1 0x555558d5fa94 in object_finalize qom/object.c:618:9
    #2 0x555558d57651 in object_unref qom/object.c:1068:9
    #3 0x555558a55588 in migration_thread migration/migration.c:3272:5
    #4 0x5555595393f2 in qemu_thread_start util/qemu-thread-posix.c:502:9
    #5 0x7fffe057f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

previously allocated by thread T0 (qemu-vm-0) here:
    #0 0x555556f76b03 in __interceptor_malloc
      /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
    #1 0x7ffff6ee37b8 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f7b8)
    #2 0x555558d58031 in object_new qom/object.c:640:12
    #3 0x555558a31f21 in migration_object_init migration/migration.c:139:25
    #4 0x555557c41398 in main vl.c:4320:5
    #5 0x7fffdfdb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Thread T6 (live_migration) created by T0 (qemu-vm-0) here:
    #0 0x555556f5f0dd in pthread_create
      /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
    #1 0x555559538cf9 in qemu_thread_create util/qemu-thread-posix.c:539:11
    #2 0x555558a53304 in migrate_fd_connect migration/migration.c:3332:5
    #3 0x555558a72bd8 in migration_channel_connect migration/channel.c:92:5
    #4 0x555558a6ef87 in exec_start_outgoing_migration migration/exec.c:42:5
    #5 0x555558a4f3c2 in qmp_migrate migration/migration.c:1922:9
    #6 0x555558bb4f6a in qmp_marshal_migrate qapi/qapi-commands-migration.c:607:5
    #7 0x555559363738 in do_qmp_dispatch qapi/qmp-dispatch.c:131:5
    #8 0x555559362a15 in qmp_dispatch qapi/qmp-dispatch.c:174:11
    #9 0x5555571bac15 in monitor_qmp_dispatch monitor.c:4124:11
    #10 0x55555719a22d in monitor_qmp_bh_dispatcher monitor.c:4207:9
    #11 0x5555594fde0a in aio_bh_call util/async.c:90:5
    #12 0x5555594fe522 in aio_bh_poll util/async.c:118:13
    #13 0x5555595201e0 in aio_dispatch util/aio-posix.c:460:5
    #14 0x555559503553 in aio_ctx_dispatch util/async.c:261:5
    #15 0x7ffff6ede196 in g_main_context_dispatch
      (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a196)

SUMMARY: AddressSanitizer: heap-use-after-free migration/migration.c:1502:23
  in migrate_fd_cleanup
Shadow bytes around the buggy address:
  0x0c327fffb9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fffba00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fffba10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fffba20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fffba30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c327fffba40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fffba50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fffba60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fffba70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fffba80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fffba90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
  Shadow gap: cc
==31958==ABORTING

Signed-off-by: Yury Kotov <[email protected]>
Message-Id: <20190408113343[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>
  Fixed up comment formatting

migration/savevm: wrap into qemu_loadvm_state_header()

On source side, we have qemu_savevm_state_header() to send related data,
while on the receiving side those steps are scattered in
qemu_loadvm_state().

This patch wrap those related steps into qemu_loadvm_state_header() to
make it friendly to read.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190424004700[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration/savevm: load_header before load_setup

In migration_thread() and qemu_savevm_state(), we savevm_state in
following sequence:

    qemu_savevm_state_header(f);
    qemu_savevm_state_setup(f);

Then it would be more proper to loadvm_state in the save sequence.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190424004700[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration/savevm: remove duplicate check of migration_is_blocked

Current call flow of save_snapshot is:

  save_snapshot
    migration_is_blocked
      qemu_savevm_state
        migration_is_blocked

Since qemu_savevm_state is only called in save_snapshot, this means
migration_is_blocked has been already checked.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190424004700[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration: update comments of migration bitmap

Since the ram bitmap and the unsent bitmap are split by RAMBlock
in commit 6b6712e, it's better to update the comments about them.

Signed-off-by: Yi Wang <[email protected]>
Message-Id: <1555311089[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration/ram.c: start of migration_bitmap_sync_range is always 0

We can eliminate to pass 0.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190430034412[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

qemu-option.hx: Update missed parameter for colo-compare

We missed the iothread related args in this file.
This patch is used to fix this issue.

Signed-off-by: Zhang Chen <[email protected]>
Message-Id: <20190426090730[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration/colo.h: Remove obsolete codes

Signed-off-by: Zhang Chen <[email protected]>
Message-Id: <20190426090730[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration/colo.c: Remove redundant input parameter

The colo_do_failover no need the input parameter.

Signed-off-by: Zhang Chen <[email protected]>
Message-Id: <20190426090730[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration: savevm: fix error code with migration blockers

The only caller that checks the error code is looking for != 0,
so returning false is incorrect.

Fixes: 5aaac467938 "migration: savevm: consult migration blockers"
Signed-off-by: Cole Robinson <[email protected]>
Message-Id: <b991a4d0e6c4253bc08b2794c6084be55fc72e1d.1554851834[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Reviewed-by: Juan Quintela <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

vmstate: check subsection_found is enough

subsection_found is true implies vmdesc is not NULL.

This patch remove the additional check on vmdesc and rename
subsection_found to vmdesc_has_subsections to make it more self-explain.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190403011016[email protected]>
Acked-by: Stefano Garzarella <[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration: remove not used field xfer_limit

MigrationState->xfer_limit is only set to 0 in migrate_init().

Remove this unnecessary field.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190326055726[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration: not necessary to check ops again

During each iteration, se->ops is checked before each loop. So it is not
necessary to check it again and simplify the following check a little.

Signed-off-by: Wei Yang <[email protected]>
Message-Id: <20190327013130[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

migration: comment VMSTATE_UNUSED*() properly

It is error prone to use VMSTATE_UNUSED*() sometimes especially when
the size of the migration stream of the field is not the same as the
size of the structure (boolean is one example).  Comment it well so
people will be aware of this when people want to use it.

Signed-off-by: Peter Xu <[email protected]>
Message-Id: <20190329095713[email protected]>
Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Dr. David Alan Gilbert <[email protected]>

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190513' into staging

Improve code generation for vector duplication.
Add vector expansions for shifts by non-constant scalar.
Add vector expansions for shifts by vector.
Add integer and vector expansions for absolute value.
Several patches in preparation for Altivec.
Bug fix for tcg/aarch64 vs min/max.

# gpg: Signature made Tue 14 May 2019 00:58:02 BST
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "[email protected]"
# gpg: Good signature from "Richard Henderson <[email protected]>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20190513: (31 commits)
  tcg/aarch64: Do not advertise minmax for MO_64
  target/xtensa: Use tcg_gen_abs_i32
  target/tricore: Use tcg_gen_abs_tl
  target/s390x: Use tcg_gen_abs_i64
  target/ppc: Use tcg_gen_abs_tl
  target/ppc: Use tcg_gen_abs_i32
  target/cris: Use tcg_gen_abs_tl
  target/arm: Use tcg_gen_abs_i64 and tcg_gen_gvec_abs
  tcg/aarch64: Support vector absolute value
  tcg/i386: Support vector absolute value
  tcg: Add support for vector absolute value
  tcg: Add support for integer absolute value
  tcg/i386: Support vector scalar shift opcodes
  tcg: Add gvec expanders for vector shift by scalar
  tcg/aarch64: Support vector variable shift opcodes
  tcg/i386: Support vector variable shift opcodes
  tcg: Add gvec expanders for variable shift
  tcg: Add INDEX_op_dupm_vec
  tcg/aarch64: Implement tcg_out_dupm_vec
  tcg/i386: Implement tcg_out_dupm_vec
  ...

Signed-off-by: Peter Maydell <[email protected]>

tcg/aarch64: Do not advertise minmax for MO_64

The min/max instructions are not available for 64-bit elements.

Fixes: 93f332a50371
Signed-off-by: Richard Henderson <[email protected]>

target/xtensa: Use tcg_gen_abs_i32

Acked-by: Max Filippov <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/tricore: Use tcg_gen_abs_tl

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <20190423102145[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/s390x: Use tcg_gen_abs_i64

Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/ppc: Use tcg_gen_abs_tl

Signed-off-by: Richard Henderson <[email protected]>

target/ppc: Use tcg_gen_abs_i32

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <20190423102145[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/cris: Use tcg_gen_abs_tl

Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

target/arm: Use tcg_gen_abs_i64 and tcg_gen_gvec_abs

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg/aarch64: Support vector absolute value

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg/i386: Support vector absolute value

Signed-off-by: Richard Henderson <[email protected]>

tcg: Add support for vector absolute value

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Add support for integer absolute value

Remove a function of the same name from target/arm/.
Use a branchless implementation of abs gleaned from gcc.

Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg/i386: Support vector scalar shift opcodes

Signed-off-by: Richard Henderson <[email protected]>

tcg: Add gvec expanders for vector shift by scalar

Allow expansion either via shift by scalar or by replicating
the scalar for shift by vector.

Signed-off-by: Richard Henderson <[email protected]>
---
v3: Use a private structure for do_gvec_shifts.

tcg/aarch64: Support vector variable shift opcodes

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg/i386: Support vector variable shift opcodes

Signed-off-by: Richard Henderson <[email protected]>

tcg: Add gvec expanders for variable shift

The gvec expanders perform a modulo on the shift count.  If the target
requires alternate behaviour, then it cannot use the generic gvec
expanders anyway, and will have to have its own custom code.

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Add INDEX_op_dupm_vec

Allow the backend to expand dup from memory directly, instead of
forcing the value into a temp first.  This is especially important
if integer/vector register moves do not exist.

Note that officially tcg_out_dupm_vec is allowed to fail.
If it did, we could fix this up relatively easily:

  VECE == 32/64:
    Load the value into a vector register, then dup.
    Both of these must work.

  VECE == 8/16:
    If the value happens to be at an offset such that an aligned
    load would place the desired value in the least significant
    end of the register, go ahead and load w/garbage in high bits.

    Load the value w/INDEX_op_ld{8,16}_i32.
    Attempt a move directly to vector reg, which may fail.
    Store the value into the backing store for OTS.
    Load the value into the vector reg w/TCG_TYPE_I32, which must work.
    Duplicate from the vector reg into itself, which must work.

All of which is well and good, except that all supported
hosts can support dupm for all vece, so all of the failure
paths would be dead code and untestable.

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg/aarch64: Implement tcg_out_dupm_vec

The LD1R instruction does all the work.  Note that the only
useful addressing mode is a base register with no offset.

Signed-off-by: Richard Henderson <[email protected]>

tcg/i386: Implement tcg_out_dupm_vec

At the same time, improve tcg_out_dupi_vec wrt broadcast
from the constant pool.

Signed-off-by: Richard Henderson <[email protected]>

tcg: Add tcg_out_dupm_vec to the backend interface

Currently stubbed out in all backends that support vectors.

Signed-off-by: Richard Henderson <[email protected]>

tcg: Manually expand INDEX_op_dup_vec

This case is similar to INDEX_op_mov_* in that we need to do
different things depending on the current location of the source.

Signed-off-by: Richard Henderson <[email protected]>
---
v3: Added some commentary to the tcg_reg_alloc_* functions.

tcg: Promote tcg_out_{dup,dupi}_vec to backend interface

The i386 backend already has these functions, and the aarch64 backend
could easily split out one.  Nothing is done with these functions yet,
but this will aid register allocation of INDEX_op_dup_vec in a later patch.

Adjust the aarch64 tcg_out_dupi_vec signature to match the new interface.

Reviewed-by: Alex Bennée <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Support cross-class moves without instruction support

PowerPC Altivec does not support direct moves between vector registers
and general registers.  So when tcg_out_mov fails, we can use the
backing memory for the temporary to perform the move.

Acked-by: David Hildenbrand <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Return bool success from tcg_out_mov

This patch merely changes the interface, aborting on all failures,
of which there are currently none.

Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: David Gibson <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg/arm: Use tcg_out_mov_reg in tcg_out_mov

We have a function that takes an additional condition parameter
over the standard backend interface.  It already takes care of
eliding no-op moves.

Signed-off-by: Richard Henderson <[email protected]>

tcg: Assert fixed_reg is read-only

The only fixed_reg is cpu_env, and it should not be modified
during any TB.  Therefore code that tries to special-case moves
into a fixed_reg is dead.  Remove it.

Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: David Hildenbrand <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>