1 | The following changes since commit 013a18edbbc59cdad019100c7d03c0494642b74c: | 1 | The following changes since commit 00b1faea41d283e931256aa78aa975a369ec3ae6: |
---|---|---|---|
2 | 2 | ||
3 | Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-2020051= | 3 | Merge tag 'pull-target-arm-20230123' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2023-01-23 13:40:28 +0000) |
4 | 4' into staging (2020-05-14 16:17:55 +0100) | ||
5 | 4 | ||
6 | are available in the Git repository at: | 5 | are available in the Git repository at: |
7 | 6 | ||
8 | https://github.com/stefanha/qemu.git tags/block-pull-request | 7 | https://gitlab.com/stefanha/qemu.git tags/block-pull-request |
9 | 8 | ||
10 | for you to fetch changes up to ba607ca8bff4d2c2062902f8355657c865ac7c29: | 9 | for you to fetch changes up to 4f01a9bb0461e8c11ee0c94d90a504cb7d580a85: |
11 | 10 | ||
12 | aio-posix: disable fdmon-io_uring when GSource is used (2020-05-18 18:16:00= | 11 | block/blkio: Fix inclusion of required headers (2023-01-23 15:02:07 -0500) |
13 | +0100) | ||
14 | 12 | ||
15 | ---------------------------------------------------------------- | 13 | ---------------------------------------------------------------- |
16 | Pull request | 14 | Pull request |
17 | 15 | ||
18 | ---------------------------------------------------------------- | 16 | ---------------------------------------------------------------- |
19 | 17 | ||
20 | Philippe Mathieu-Daud=C3=A9 (6): | 18 | Chao Gao (1): |
21 | tests/fuzz/Makefile: Do not link code using unavailable devices | 19 | util/aio: Defer disabling poll mode as long as possible |
22 | Makefile: List fuzz targets in 'make help' | ||
23 | tests/fuzz: Add missing space in test description | ||
24 | tests/fuzz: Remove unuseful/unused typedefs | ||
25 | tests/fuzz: Extract pciconfig_fuzz_qos() method | ||
26 | tests/fuzz: Extract ioport_fuzz_qtest() method | ||
27 | 20 | ||
28 | Stefan Hajnoczi (2): | 21 | Peter Krempa (1): |
29 | aio-posix: don't duplicate fd handler deletion in | 22 | block/blkio: Fix inclusion of required headers |
30 | fdmon_io_uring_destroy() | ||
31 | aio-posix: disable fdmon-io_uring when GSource is used | ||
32 | 23 | ||
33 | Makefile | 6 +++- | 24 | Stefan Hajnoczi (1): |
34 | tests/qtest/fuzz/Makefile.include | 6 ++-- | 25 | virtio-blk: simplify virtio_blk_dma_restart_cb() |
35 | include/block/aio.h | 3 ++ | ||
36 | tests/qtest/fuzz/i440fx_fuzz.c | 47 ++++++++++++++++++++----------- | ||
37 | util/aio-posix.c | 13 +++++++++ | ||
38 | util/aio-win32.c | 4 +++ | ||
39 | util/async.c | 1 + | ||
40 | util/fdmon-io_uring.c | 13 +++++++-- | ||
41 | 8 files changed, 69 insertions(+), 24 deletions(-) | ||
42 | 26 | ||
43 | --=20 | 27 | include/hw/virtio/virtio-blk.h | 2 -- |
44 | 2.25.3 | 28 | block/blkio.c | 2 ++ |
29 | hw/block/dataplane/virtio-blk.c | 17 +++++------- | ||
30 | hw/block/virtio-blk.c | 46 ++++++++++++++------------------- | ||
31 | util/aio-posix.c | 21 ++++++++++----- | ||
32 | 5 files changed, 43 insertions(+), 45 deletions(-) | ||
45 | 33 | ||
34 | -- | ||
35 | 2.39.0 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
2 | 1 | ||
3 | Some devices availability depends on CONFIG options. | ||
4 | Use these options to only link tests when requested device | ||
5 | is available. | ||
6 | |||
7 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
8 | Message-id: 20200514143433.18569-2-philmd@redhat.com | ||
9 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
10 | --- | ||
11 | tests/qtest/fuzz/Makefile.include | 6 +++--- | ||
12 | 1 file changed, 3 insertions(+), 3 deletions(-) | ||
13 | |||
14 | diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include | ||
15 | index XXXXXXX..XXXXXXX 100644 | ||
16 | --- a/tests/qtest/fuzz/Makefile.include | ||
17 | +++ b/tests/qtest/fuzz/Makefile.include | ||
18 | @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o | ||
19 | fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o | ||
20 | |||
21 | # Targets | ||
22 | -fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o | ||
23 | -fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o | ||
24 | -fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o | ||
25 | +fuzz-obj-$(CONFIG_PCI_I440FX) += tests/qtest/fuzz/i440fx_fuzz.o | ||
26 | +fuzz-obj-$(CONFIG_VIRTIO_NET) += tests/qtest/fuzz/virtio_net_fuzz.o | ||
27 | +fuzz-obj-$(CONFIG_SCSI) += tests/qtest/fuzz/virtio_scsi_fuzz.o | ||
28 | |||
29 | FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest | ||
30 | |||
31 | -- | ||
32 | 2.25.3 | ||
33 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
2 | 1 | ||
3 | List softmmu fuzz targets in 'make help' output: | ||
4 | |||
5 | $ make help | ||
6 | ... | ||
7 | Architecture specific targets: | ||
8 | aarch64-softmmu/all - Build for aarch64-softmmu | ||
9 | aarch64-softmmu/fuzz - Build fuzzer for aarch64-softmmu | ||
10 | alpha-softmmu/all - Build for alpha-softmmu | ||
11 | alpha-softmmu/fuzz - Build fuzzer for alpha-softmmu | ||
12 | arm-softmmu/all - Build for arm-softmmu | ||
13 | arm-softmmu/fuzz - Build fuzzer for arm-softmmu | ||
14 | ... | ||
15 | |||
16 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
17 | Message-id: 20200514143433.18569-3-philmd@redhat.com | ||
18 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
19 | --- | ||
20 | Makefile | 6 +++++- | ||
21 | 1 file changed, 5 insertions(+), 1 deletion(-) | ||
22 | |||
23 | diff --git a/Makefile b/Makefile | ||
24 | index XXXXXXX..XXXXXXX 100644 | ||
25 | --- a/Makefile | ||
26 | +++ b/Makefile | ||
27 | @@ -XXX,XX +XXX,XX @@ endif | ||
28 | @$(if $(TARGET_DIRS), \ | ||
29 | echo 'Architecture specific targets:'; \ | ||
30 | $(foreach t, $(TARGET_DIRS), \ | ||
31 | - $(call print-help-run,$(t)/all,Build for $(t));) \ | ||
32 | + $(call print-help-run,$(t)/all,Build for $(t)); \ | ||
33 | + $(if $(CONFIG_FUZZ), \ | ||
34 | + $(if $(findstring softmmu,$(t)), \ | ||
35 | + $(call print-help-run,$(t)/fuzz,Build fuzzer for $(t)); \ | ||
36 | + ))) \ | ||
37 | echo '') | ||
38 | @$(if $(TOOLS), \ | ||
39 | echo 'Tools targets:'; \ | ||
40 | -- | ||
41 | 2.25.3 | ||
42 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
2 | 1 | ||
3 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
4 | Message-id: 20200514143433.18569-4-philmd@redhat.com | ||
5 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
6 | --- | ||
7 | tests/qtest/fuzz/i440fx_fuzz.c | 6 +++--- | ||
8 | 1 file changed, 3 insertions(+), 3 deletions(-) | ||
9 | |||
10 | diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c | ||
11 | index XXXXXXX..XXXXXXX 100644 | ||
12 | --- a/tests/qtest/fuzz/i440fx_fuzz.c | ||
13 | +++ b/tests/qtest/fuzz/i440fx_fuzz.c | ||
14 | @@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void) | ||
15 | /* Uses simple qtest commands and reboots to reset state */ | ||
16 | fuzz_add_target(&(FuzzTarget){ | ||
17 | .name = "i440fx-qtest-reboot-fuzz", | ||
18 | - .description = "Fuzz the i440fx using raw qtest commands and" | ||
19 | + .description = "Fuzz the i440fx using raw qtest commands and " | ||
20 | "rebooting after each run", | ||
21 | .get_init_cmdline = i440fx_argv, | ||
22 | .fuzz = i440fx_fuzz_qtest}); | ||
23 | @@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void) | ||
24 | /* Uses libqos and forks to prevent state leakage */ | ||
25 | fuzz_add_qos_target(&(FuzzTarget){ | ||
26 | .name = "i440fx-qos-fork-fuzz", | ||
27 | - .description = "Fuzz the i440fx using raw qtest commands and" | ||
28 | + .description = "Fuzz the i440fx using raw qtest commands and " | ||
29 | "rebooting after each run", | ||
30 | .pre_vm_init = &fork_init, | ||
31 | .fuzz = i440fx_fuzz_qos_fork,}, | ||
32 | @@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void) | ||
33 | */ | ||
34 | fuzz_add_qos_target(&(FuzzTarget){ | ||
35 | .name = "i440fx-qos-noreset-fuzz", | ||
36 | - .description = "Fuzz the i440fx using raw qtest commands and" | ||
37 | + .description = "Fuzz the i440fx using raw qtest commands and " | ||
38 | "rebooting after each run", | ||
39 | .fuzz = i440fx_fuzz_qos,}, | ||
40 | "i440FX-pcihost", | ||
41 | -- | ||
42 | 2.25.3 | ||
43 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
2 | 1 | ||
3 | These typedefs are not used. Use a simple structure, | ||
4 | remote the typedefs. | ||
5 | |||
6 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
7 | Message-id: 20200514143433.18569-5-philmd@redhat.com | ||
8 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
9 | --- | ||
10 | tests/qtest/fuzz/i440fx_fuzz.c | 10 ++++------ | ||
11 | 1 file changed, 4 insertions(+), 6 deletions(-) | ||
12 | |||
13 | diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c | ||
14 | index XXXXXXX..XXXXXXX 100644 | ||
15 | --- a/tests/qtest/fuzz/i440fx_fuzz.c | ||
16 | +++ b/tests/qtest/fuzz/i440fx_fuzz.c | ||
17 | @@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s, | ||
18 | * loop over the Data, breaking it up into actions. each action has an | ||
19 | * opcode, address offset and value | ||
20 | */ | ||
21 | - typedef struct QTestFuzzAction { | ||
22 | + struct { | ||
23 | uint8_t opcode; | ||
24 | uint8_t addr; | ||
25 | uint32_t value; | ||
26 | - } QTestFuzzAction; | ||
27 | - QTestFuzzAction a; | ||
28 | + } a; | ||
29 | |||
30 | while (Size >= sizeof(a)) { | ||
31 | /* make a copy of the action so we can normalize the values in-place */ | ||
32 | @@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s, | ||
33 | * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the | ||
34 | * value written over Port IO | ||
35 | */ | ||
36 | - typedef struct QOSFuzzAction { | ||
37 | + struct { | ||
38 | uint8_t opcode; | ||
39 | uint8_t offset; | ||
40 | int devfn; | ||
41 | uint32_t value; | ||
42 | - } QOSFuzzAction; | ||
43 | + } a; | ||
44 | |||
45 | static QPCIBus *bus; | ||
46 | if (!bus) { | ||
47 | bus = qpci_new_pc(s, fuzz_qos_alloc); | ||
48 | } | ||
49 | |||
50 | - QOSFuzzAction a; | ||
51 | while (Size >= sizeof(a)) { | ||
52 | memcpy(&a, Data, sizeof(a)); | ||
53 | switch (a.opcode % ACTION_MAX) { | ||
54 | -- | ||
55 | 2.25.3 | ||
56 | diff view generated by jsdifflib |
1 | The io_uring file descriptor monitoring implementation has an internal | 1 | From: Chao Gao <chao.gao@intel.com> |
---|---|---|---|
2 | list of fd handlers that are pending submission to io_uring. | ||
3 | fdmon_io_uring_destroy() deletes all fd handlers on the list. | ||
4 | 2 | ||
5 | Don't delete fd handlers directly in fdmon_io_uring_destroy() for two | 3 | When we measure FIO read performance (cache=writethrough, bs=4k, |
6 | reasons: | 4 | iodepth=64) in VMs, ~80K/s notifications (e.g., EPT_MISCONFIG) are observed |
7 | 1. This duplicates the aio-posix.c AioHandler deletion code and could | 5 | from guest to qemu. |
8 | become outdated if the struct changes. | ||
9 | 2. Only handlers with the FDMON_IO_URING_REMOVE flag set are safe to | ||
10 | remove. If the flag is not set then something still has a pointer to | ||
11 | the fd handler. Let aio-posix.c and its user worry about that. In | ||
12 | practice this isn't an issue because fdmon_io_uring_destroy() is only | ||
13 | called when shutting down so all users have removed their fd | ||
14 | handlers, but the next patch will need this! | ||
15 | 6 | ||
16 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 7 | It turns out those frequent notificatons are caused by interference from |
17 | Tested-by: Oleksandr Natalenko <oleksandr@redhat.com> | 8 | worker threads. Worker threads queue bottom halves after completing IO |
18 | Message-id: 20200511183630.279750-2-stefanha@redhat.com | 9 | requests. Pending bottom halves may lead to either aio_compute_timeout() |
10 | zeros timeout and pass it to try_poll_mode() or run_poll_handlers() returns | ||
11 | no progress after noticing pending aio_notify() events. Both cause | ||
12 | run_poll_handlers() to call poll_set_started(false) to disable poll mode. | ||
13 | However, for both cases, as timeout is already zeroed, the event loop | ||
14 | (i.e., aio_poll()) just processes bottom halves and then starts the next | ||
15 | event loop iteration. So, disabling poll mode has no value but leads to | ||
16 | unnecessary notifications from guest. | ||
17 | |||
18 | To minimize unnecessary notifications from guest, defer disabling poll | ||
19 | mode to when the event loop is about to be blocked. | ||
20 | |||
21 | With this patch applied, FIO seq-read performance (bs=4k, iodepth=64, | ||
22 | cache=writethrough) in VMs increases from 330K/s to 413K/s IOPS. | ||
23 | |||
24 | Suggested-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
25 | Signed-off-by: Chao Gao <chao.gao@intel.com> | ||
26 | Message-id: 20220710120849.63086-1-chao.gao@intel.com | ||
19 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 27 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
20 | --- | 28 | --- |
21 | util/aio-posix.c | 1 + | 29 | util/aio-posix.c | 21 +++++++++++++++------ |
22 | util/fdmon-io_uring.c | 13 ++++++++++--- | 30 | 1 file changed, 15 insertions(+), 6 deletions(-) |
23 | 2 files changed, 11 insertions(+), 3 deletions(-) | ||
24 | 31 | ||
25 | diff --git a/util/aio-posix.c b/util/aio-posix.c | 32 | diff --git a/util/aio-posix.c b/util/aio-posix.c |
26 | index XXXXXXX..XXXXXXX 100644 | 33 | index XXXXXXX..XXXXXXX 100644 |
27 | --- a/util/aio-posix.c | 34 | --- a/util/aio-posix.c |
28 | +++ b/util/aio-posix.c | 35 | +++ b/util/aio-posix.c |
29 | @@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx) | 36 | @@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list, |
30 | { | 37 | |
31 | fdmon_io_uring_destroy(ctx); | 38 | max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns); |
32 | fdmon_epoll_disable(ctx); | 39 | if (max_ns && !ctx->fdmon_ops->need_wait(ctx)) { |
33 | + aio_free_deleted_handlers(ctx); | 40 | + /* |
41 | + * Enable poll mode. It pairs with the poll_set_started() in | ||
42 | + * aio_poll() which disables poll mode. | ||
43 | + */ | ||
44 | poll_set_started(ctx, ready_list, true); | ||
45 | |||
46 | if (run_poll_handlers(ctx, ready_list, max_ns, timeout)) { | ||
47 | return true; | ||
48 | } | ||
49 | } | ||
50 | - | ||
51 | - if (poll_set_started(ctx, ready_list, false)) { | ||
52 | - *timeout = 0; | ||
53 | - return true; | ||
54 | - } | ||
55 | - | ||
56 | return false; | ||
34 | } | 57 | } |
35 | 58 | ||
36 | void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns, | 59 | @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) |
37 | diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c | 60 | * system call---a single round of run_poll_handlers_once suffices. |
38 | index XXXXXXX..XXXXXXX 100644 | 61 | */ |
39 | --- a/util/fdmon-io_uring.c | 62 | if (timeout || ctx->fdmon_ops->need_wait(ctx)) { |
40 | +++ b/util/fdmon-io_uring.c | 63 | + /* |
41 | @@ -XXX,XX +XXX,XX @@ void fdmon_io_uring_destroy(AioContext *ctx) | 64 | + * Disable poll mode. poll mode should be disabled before the call |
42 | 65 | + * of ctx->fdmon_ops->wait() so that guest's notification can wake | |
43 | io_uring_queue_exit(&ctx->fdmon_io_uring); | 66 | + * up IO threads when some work becomes pending. It is essential to |
44 | 67 | + * avoid hangs or unnecessary latency. | |
45 | - /* No need to submit these anymore, just free them. */ | 68 | + */ |
46 | + /* Move handlers due to be removed onto the deleted list */ | 69 | + if (poll_set_started(ctx, &ready_list, false)) { |
47 | while ((node = QSLIST_FIRST_RCU(&ctx->submit_list))) { | 70 | + timeout = 0; |
48 | + unsigned flags = atomic_fetch_and(&node->flags, | 71 | + progress = true; |
49 | + ~(FDMON_IO_URING_PENDING | | 72 | + } |
50 | + FDMON_IO_URING_ADD | | ||
51 | + FDMON_IO_URING_REMOVE)); | ||
52 | + | 73 | + |
53 | + if (flags & FDMON_IO_URING_REMOVE) { | 74 | ctx->fdmon_ops->wait(ctx, &ready_list, timeout); |
54 | + QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted); | 75 | } |
55 | + } | 76 | |
56 | + | ||
57 | QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted); | ||
58 | - QLIST_REMOVE(node, node); | ||
59 | - g_free(node); | ||
60 | } | ||
61 | |||
62 | ctx->fdmon_ops = &fdmon_poll_ops; | ||
63 | -- | 77 | -- |
64 | 2.25.3 | 78 | 2.39.0 |
65 | diff view generated by jsdifflib |
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | 1 | virtio_blk_dma_restart_cb() is tricky because the BH must deal with |
---|---|---|---|
2 | virtio_blk_data_plane_start()/virtio_blk_data_plane_stop() being called. | ||
2 | 3 | ||
3 | Extract the generic pciconfig_fuzz_qos() method from | 4 | There are two issues with the code: |
4 | i440fx_fuzz_qos(). This will help to write tests not | ||
5 | specific to the i440FX controller. | ||
6 | 5 | ||
7 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | 6 | 1. virtio_blk_realize() should use qdev_add_vm_change_state_handler() |
8 | Message-id: 20200514143433.18569-6-philmd@redhat.com | 7 | instead of qemu_add_vm_change_state_handler(). This ensures the |
8 | ordering with virtio_init()'s vm change state handler that calls | ||
9 | virtio_blk_data_plane_start()/virtio_blk_data_plane_stop() is | ||
10 | well-defined. Then blk's AioContext is guaranteed to be up-to-date in | ||
11 | virtio_blk_dma_restart_cb() and it's no longer necessary to have a | ||
12 | special case for virtio_blk_data_plane_start(). | ||
13 | |||
14 | 2. Only blk_drain() waits for virtio_blk_dma_restart_cb()'s | ||
15 | blk_inc_in_flight() to be decremented. The bdrv_drain() family of | ||
16 | functions do not wait for BlockBackend's in_flight counter to reach | ||
17 | zero. virtio_blk_data_plane_stop() relies on blk_set_aio_context()'s | ||
18 | implicit drain, but that's a bdrv_drain() and not a blk_drain(). | ||
19 | Note that virtio_blk_reset() already correctly relies on blk_drain(). | ||
20 | If virtio_blk_data_plane_stop() switches to blk_drain() then we can | ||
21 | properly wait for pending virtio_blk_dma_restart_bh() calls. | ||
22 | |||
23 | Once these issues are taken care of the code becomes simpler. This | ||
24 | change is in preparation for multiple IOThreads in virtio-blk where we | ||
25 | need to clean up the multi-threading behavior. | ||
26 | |||
27 | I ran the reproducer from commit 49b44549ace7 ("virtio-blk: On restart, | ||
28 | process queued requests in the proper context") to check that there is | ||
29 | no regression. | ||
30 | |||
31 | Cc: Sergio Lopez <slp@redhat.com> | ||
32 | Cc: Kevin Wolf <kwolf@redhat.com> | ||
33 | Cc: Emanuele Giuseppe Esposito <eesposit@redhat.com> | ||
34 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
35 | Acked-by: Michael S. Tsirkin <mst@redhat.com> | ||
36 | Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com> | ||
37 | Message-id: 20221102182337.252202-1-stefanha@redhat.com | ||
9 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 38 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
10 | --- | 39 | --- |
11 | tests/qtest/fuzz/i440fx_fuzz.c | 20 ++++++++++++++------ | 40 | include/hw/virtio/virtio-blk.h | 2 -- |
12 | 1 file changed, 14 insertions(+), 6 deletions(-) | 41 | hw/block/dataplane/virtio-blk.c | 17 +++++------- |
42 | hw/block/virtio-blk.c | 46 ++++++++++++++------------------- | ||
43 | 3 files changed, 26 insertions(+), 39 deletions(-) | ||
13 | 44 | ||
14 | diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c | 45 | diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h |
15 | index XXXXXXX..XXXXXXX 100644 | 46 | index XXXXXXX..XXXXXXX 100644 |
16 | --- a/tests/qtest/fuzz/i440fx_fuzz.c | 47 | --- a/include/hw/virtio/virtio-blk.h |
17 | +++ b/tests/qtest/fuzz/i440fx_fuzz.c | 48 | +++ b/include/hw/virtio/virtio-blk.h |
18 | @@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s, | 49 | @@ -XXX,XX +XXX,XX @@ struct VirtIOBlock { |
19 | flush_events(s); | 50 | VirtIODevice parent_obj; |
51 | BlockBackend *blk; | ||
52 | void *rq; | ||
53 | - QEMUBH *bh; | ||
54 | VirtIOBlkConf conf; | ||
55 | unsigned short sector_mask; | ||
56 | bool original_wce; | ||
57 | @@ -XXX,XX +XXX,XX @@ typedef struct MultiReqBuffer { | ||
58 | } MultiReqBuffer; | ||
59 | |||
60 | void virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq); | ||
61 | -void virtio_blk_process_queued_requests(VirtIOBlock *s, bool is_bh); | ||
62 | |||
63 | #endif | ||
64 | diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c | ||
65 | index XXXXXXX..XXXXXXX 100644 | ||
66 | --- a/hw/block/dataplane/virtio-blk.c | ||
67 | +++ b/hw/block/dataplane/virtio-blk.c | ||
68 | @@ -XXX,XX +XXX,XX @@ int virtio_blk_data_plane_start(VirtIODevice *vdev) | ||
69 | goto fail_aio_context; | ||
70 | } | ||
71 | |||
72 | - /* Process queued requests before the ones in vring */ | ||
73 | - virtio_blk_process_queued_requests(vblk, false); | ||
74 | - | ||
75 | /* Kick right away to begin processing requests already in vring */ | ||
76 | for (i = 0; i < nvqs; i++) { | ||
77 | VirtQueue *vq = virtio_get_queue(s->vdev, i); | ||
78 | @@ -XXX,XX +XXX,XX @@ int virtio_blk_data_plane_start(VirtIODevice *vdev) | ||
79 | fail_host_notifiers: | ||
80 | k->set_guest_notifiers(qbus->parent, nvqs, false); | ||
81 | fail_guest_notifiers: | ||
82 | - /* | ||
83 | - * If we failed to set up the guest notifiers queued requests will be | ||
84 | - * processed on the main context. | ||
85 | - */ | ||
86 | - virtio_blk_process_queued_requests(vblk, false); | ||
87 | vblk->dataplane_disabled = true; | ||
88 | s->starting = false; | ||
89 | vblk->dataplane_started = true; | ||
90 | @@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev) | ||
91 | aio_context_acquire(s->ctx); | ||
92 | aio_wait_bh_oneshot(s->ctx, virtio_blk_data_plane_stop_bh, s); | ||
93 | |||
94 | - /* Drain and try to switch bs back to the QEMU main loop. If other users | ||
95 | - * keep the BlockBackend in the iothread, that's ok */ | ||
96 | + /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */ | ||
97 | + blk_drain(s->conf->conf.blk); | ||
98 | + | ||
99 | + /* | ||
100 | + * Try to switch bs back to the QEMU main loop. If other users keep the | ||
101 | + * BlockBackend in the iothread, that's ok | ||
102 | + */ | ||
103 | blk_set_aio_context(s->conf->conf.blk, qemu_get_aio_context(), NULL); | ||
104 | |||
105 | aio_context_release(s->ctx); | ||
106 | diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c | ||
107 | index XXXXXXX..XXXXXXX 100644 | ||
108 | --- a/hw/block/virtio-blk.c | ||
109 | +++ b/hw/block/virtio-blk.c | ||
110 | @@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq) | ||
111 | virtio_blk_handle_vq(s, vq); | ||
20 | } | 112 | } |
21 | 113 | ||
22 | -static void i440fx_fuzz_qos(QTestState *s, | 114 | -void virtio_blk_process_queued_requests(VirtIOBlock *s, bool is_bh) |
23 | +static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus, | 115 | +static void virtio_blk_dma_restart_bh(void *opaque) |
24 | const unsigned char *Data, size_t Size) { | 116 | { |
25 | /* | 117 | + VirtIOBlock *s = opaque; |
26 | * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the | 118 | + |
27 | @@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s, | 119 | VirtIOBlockReq *req = s->rq; |
28 | uint32_t value; | 120 | MultiReqBuffer mrb = {}; |
29 | } a; | 121 | |
30 | 122 | @@ -XXX,XX +XXX,XX @@ void virtio_blk_process_queued_requests(VirtIOBlock *s, bool is_bh) | |
31 | - static QPCIBus *bus; | 123 | if (mrb.num_reqs) { |
32 | - if (!bus) { | 124 | virtio_blk_submit_multireq(s, &mrb); |
33 | - bus = qpci_new_pc(s, fuzz_qos_alloc); | 125 | } |
126 | - if (is_bh) { | ||
127 | - blk_dec_in_flight(s->conf.conf.blk); | ||
34 | - } | 128 | - } |
129 | + | ||
130 | + /* Paired with inc in virtio_blk_dma_restart_cb() */ | ||
131 | + blk_dec_in_flight(s->conf.conf.blk); | ||
132 | + | ||
133 | aio_context_release(blk_get_aio_context(s->conf.conf.blk)); | ||
134 | } | ||
135 | |||
136 | -static void virtio_blk_dma_restart_bh(void *opaque) | ||
137 | -{ | ||
138 | - VirtIOBlock *s = opaque; | ||
35 | - | 139 | - |
36 | while (Size >= sizeof(a)) { | 140 | - qemu_bh_delete(s->bh); |
37 | memcpy(&a, Data, sizeof(a)); | 141 | - s->bh = NULL; |
38 | switch (a.opcode % ACTION_MAX) { | 142 | - |
39 | @@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s, | 143 | - virtio_blk_process_queued_requests(s, true); |
40 | flush_events(s); | 144 | -} |
145 | - | ||
146 | static void virtio_blk_dma_restart_cb(void *opaque, bool running, | ||
147 | RunState state) | ||
148 | { | ||
149 | VirtIOBlock *s = opaque; | ||
150 | - BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(s))); | ||
151 | - VirtioBusState *bus = VIRTIO_BUS(qbus); | ||
152 | |||
153 | if (!running) { | ||
154 | return; | ||
155 | } | ||
156 | |||
157 | - /* | ||
158 | - * If ioeventfd is enabled, don't schedule the BH here as queued | ||
159 | - * requests will be processed while starting the data plane. | ||
160 | - */ | ||
161 | - if (!s->bh && !virtio_bus_ioeventfd_enabled(bus)) { | ||
162 | - s->bh = aio_bh_new(blk_get_aio_context(s->conf.conf.blk), | ||
163 | - virtio_blk_dma_restart_bh, s); | ||
164 | - blk_inc_in_flight(s->conf.conf.blk); | ||
165 | - qemu_bh_schedule(s->bh); | ||
166 | - } | ||
167 | + /* Paired with dec in virtio_blk_dma_restart_bh() */ | ||
168 | + blk_inc_in_flight(s->conf.conf.blk); | ||
169 | + | ||
170 | + aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.conf.blk), | ||
171 | + virtio_blk_dma_restart_bh, s); | ||
41 | } | 172 | } |
42 | 173 | ||
43 | +static void i440fx_fuzz_qos(QTestState *s, | 174 | static void virtio_blk_reset(VirtIODevice *vdev) |
44 | + const unsigned char *Data, | 175 | @@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp) |
45 | + size_t Size) | 176 | return; |
46 | +{ | 177 | } |
47 | + static QPCIBus *bus; | 178 | |
179 | - s->change = qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s); | ||
180 | + /* | ||
181 | + * This must be after virtio_init() so virtio_blk_dma_restart_cb() gets | ||
182 | + * called after ->start_ioeventfd() has already set blk's AioContext. | ||
183 | + */ | ||
184 | + s->change = | ||
185 | + qdev_add_vm_change_state_handler(dev, virtio_blk_dma_restart_cb, s); | ||
48 | + | 186 | + |
49 | + if (!bus) { | 187 | blk_ram_registrar_init(&s->blk_ram_registrar, s->blk); |
50 | + bus = qpci_new_pc(s, fuzz_qos_alloc); | 188 | blk_set_dev_ops(s->blk, &virtio_block_ops, s); |
51 | + } | 189 | |
52 | + | ||
53 | + pciconfig_fuzz_qos(s, bus, Data, Size); | ||
54 | +} | ||
55 | + | ||
56 | static void i440fx_fuzz_qos_fork(QTestState *s, | ||
57 | const unsigned char *Data, size_t Size) { | ||
58 | if (fork() == 0) { | ||
59 | -- | 190 | -- |
60 | 2.25.3 | 191 | 2.39.0 |
61 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
2 | 1 | ||
3 | Extract generic ioport_fuzz_qtest() method from | ||
4 | i440fx_fuzz_qtest(). This will help to write tests | ||
5 | not specific to the i440FX controller. | ||
6 | |||
7 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
8 | Message-id: 20200514143433.18569-7-philmd@redhat.com | ||
9 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
10 | --- | ||
11 | tests/qtest/fuzz/i440fx_fuzz.c | 11 +++++++++-- | ||
12 | 1 file changed, 9 insertions(+), 2 deletions(-) | ||
13 | |||
14 | diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c | ||
15 | index XXXXXXX..XXXXXXX 100644 | ||
16 | --- a/tests/qtest/fuzz/i440fx_fuzz.c | ||
17 | +++ b/tests/qtest/fuzz/i440fx_fuzz.c | ||
18 | @@ -XXX,XX +XXX,XX @@ enum action_id { | ||
19 | ACTION_MAX | ||
20 | }; | ||
21 | |||
22 | -static void i440fx_fuzz_qtest(QTestState *s, | ||
23 | +static void ioport_fuzz_qtest(QTestState *s, | ||
24 | const unsigned char *Data, size_t Size) { | ||
25 | /* | ||
26 | * loop over the Data, breaking it up into actions. each action has an | ||
27 | @@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s, | ||
28 | flush_events(s); | ||
29 | } | ||
30 | |||
31 | +static void i440fx_fuzz_qtest(QTestState *s, | ||
32 | + const unsigned char *Data, | ||
33 | + size_t Size) | ||
34 | +{ | ||
35 | + ioport_fuzz_qtest(s, Data, Size); | ||
36 | +} | ||
37 | + | ||
38 | static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus, | ||
39 | const unsigned char *Data, size_t Size) { | ||
40 | /* | ||
41 | - * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the | ||
42 | + * Same as ioport_fuzz_qtest, but using QOS. devfn is incorporated into the | ||
43 | * value written over Port IO | ||
44 | */ | ||
45 | struct { | ||
46 | -- | ||
47 | 2.25.3 | ||
48 | diff view generated by jsdifflib |
1 | The glib event loop does not call fdmon_io_uring_wait() so fd handlers | 1 | From: Peter Krempa <pkrempa@redhat.com> |
---|---|---|---|
2 | waiting to be submitted build up in the list. There is no benefit is | ||
3 | using io_uring when the glib GSource is being used, so disable it | ||
4 | instead of implementing a more complex fix. | ||
5 | 2 | ||
6 | This fixes a memory leak where AioHandlers would build up and increasing | 3 | After recent header file inclusion rework the build fails when the blkio |
7 | amounts of CPU time were spent iterating them in aio_pending(). The | 4 | module is enabled: |
8 | symptom is that guests become slow when QEMU is built with io_uring | ||
9 | support. | ||
10 | 5 | ||
11 | Buglink: https://bugs.launchpad.net/qemu/+bug/1877716 | 6 | ../block/blkio.c: In function ‘blkio_detach_aio_context’: |
12 | Fixes: 73fd282e7b6dd4e4ea1c3bbb3d302c8db51e4ccf ("aio-posix: add io_uring fd monitoring implementation") | 7 | ../block/blkio.c:321:24: error: implicit declaration of function ‘bdrv_get_aio_context’; did you mean ‘qemu_get_aio_context’? [-Werror=implicit-function-declaration] |
13 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 8 | 321 | aio_set_fd_handler(bdrv_get_aio_context(bs), |
14 | Tested-by: Oleksandr Natalenko <oleksandr@redhat.com> | 9 | | ^~~~~~~~~~~~~~~~~~~~ |
15 | Message-id: 20200511183630.279750-3-stefanha@redhat.com | 10 | | qemu_get_aio_context |
11 | ../block/blkio.c:321:24: error: nested extern declaration of ‘bdrv_get_aio_context’ [-Werror=nested-externs] | ||
12 | ../block/blkio.c:321:24: error: passing argument 1 of ‘aio_set_fd_handler’ makes pointer from integer without a cast [-Werror=int-conversion] | ||
13 | 321 | aio_set_fd_handler(bdrv_get_aio_context(bs), | ||
14 | | ^~~~~~~~~~~~~~~~~~~~~~~~ | ||
15 | | | | ||
16 | | int | ||
17 | In file included from /home/pipo/git/qemu.git/include/qemu/job.h:33, | ||
18 | from /home/pipo/git/qemu.git/include/block/blockjob.h:30, | ||
19 | from /home/pipo/git/qemu.git/include/block/block_int-global-state.h:28, | ||
20 | from /home/pipo/git/qemu.git/include/block/block_int.h:27, | ||
21 | from ../block/blkio.c:13: | ||
22 | /home/pipo/git/qemu.git/include/block/aio.h:476:37: note: expected ‘AioContext *’ but argument is of type ‘int’ | ||
23 | 476 | void aio_set_fd_handler(AioContext *ctx, | ||
24 | | ~~~~~~~~~~~~^~~ | ||
25 | ../block/blkio.c: In function ‘blkio_file_open’: | ||
26 | ../block/blkio.c:821:34: error: passing argument 2 of ‘blkio_attach_aio_context’ makes pointer from integer without a cast [-Werror=int-conversion] | ||
27 | 821 | blkio_attach_aio_context(bs, bdrv_get_aio_context(bs)); | ||
28 | | ^~~~~~~~~~~~~~~~~~~~~~~~ | ||
29 | | | | ||
30 | | int | ||
31 | |||
32 | Fix it by including 'block/block-io.h' which contains the required | ||
33 | declarations. | ||
34 | |||
35 | Fixes: e2c1c34f139f49ef909bb4322607fb8b39002312 | ||
36 | Signed-off-by: Peter Krempa <pkrempa@redhat.com> | ||
37 | Reviewed-by: Markus Armbruster <armbru@redhat.com> | ||
38 | Message-id: 2bc956011404a1ab03342aefde0087b5b4762562.1674477350.git.pkrempa@redhat.com | ||
16 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> | 39 | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
17 | --- | 40 | --- |
18 | include/block/aio.h | 3 +++ | 41 | block/blkio.c | 2 ++ |
19 | util/aio-posix.c | 12 ++++++++++++ | 42 | 1 file changed, 2 insertions(+) |
20 | util/aio-win32.c | 4 ++++ | ||
21 | util/async.c | 1 + | ||
22 | 4 files changed, 20 insertions(+) | ||
23 | 43 | ||
24 | diff --git a/include/block/aio.h b/include/block/aio.h | 44 | diff --git a/block/blkio.c b/block/blkio.c |
25 | index XXXXXXX..XXXXXXX 100644 | 45 | index XXXXXXX..XXXXXXX 100644 |
26 | --- a/include/block/aio.h | 46 | --- a/block/blkio.c |
27 | +++ b/include/block/aio.h | 47 | +++ b/block/blkio.c |
28 | @@ -XXX,XX +XXX,XX @@ void aio_context_setup(AioContext *ctx); | 48 | @@ -XXX,XX +XXX,XX @@ |
29 | */ | 49 | #include "qemu/module.h" |
30 | void aio_context_destroy(AioContext *ctx); | 50 | #include "exec/memory.h" /* for ram_block_discard_disable() */ |
31 | 51 | ||
32 | +/* Used internally, do not call outside AioContext code */ | 52 | +#include "block/block-io.h" |
33 | +void aio_context_use_g_source(AioContext *ctx); | ||
34 | + | 53 | + |
35 | /** | 54 | /* |
36 | * aio_context_set_poll_params: | 55 | * Keep the QEMU BlockDriver names identical to the libblkio driver names. |
37 | * @ctx: the aio context | 56 | * Using macros instead of typing out the string literals avoids typos. |
38 | diff --git a/util/aio-posix.c b/util/aio-posix.c | ||
39 | index XXXXXXX..XXXXXXX 100644 | ||
40 | --- a/util/aio-posix.c | ||
41 | +++ b/util/aio-posix.c | ||
42 | @@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx) | ||
43 | aio_free_deleted_handlers(ctx); | ||
44 | } | ||
45 | |||
46 | +void aio_context_use_g_source(AioContext *ctx) | ||
47 | +{ | ||
48 | + /* | ||
49 | + * Disable io_uring when the glib main loop is used because it doesn't | ||
50 | + * support mixed glib/aio_poll() usage. It relies on aio_poll() being | ||
51 | + * called regularly so that changes to the monitored file descriptors are | ||
52 | + * submitted, otherwise a list of pending fd handlers builds up. | ||
53 | + */ | ||
54 | + fdmon_io_uring_destroy(ctx); | ||
55 | + aio_free_deleted_handlers(ctx); | ||
56 | +} | ||
57 | + | ||
58 | void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns, | ||
59 | int64_t grow, int64_t shrink, Error **errp) | ||
60 | { | ||
61 | diff --git a/util/aio-win32.c b/util/aio-win32.c | ||
62 | index XXXXXXX..XXXXXXX 100644 | ||
63 | --- a/util/aio-win32.c | ||
64 | +++ b/util/aio-win32.c | ||
65 | @@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx) | ||
66 | { | ||
67 | } | ||
68 | |||
69 | +void aio_context_use_g_source(AioContext *ctx) | ||
70 | +{ | ||
71 | +} | ||
72 | + | ||
73 | void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns, | ||
74 | int64_t grow, int64_t shrink, Error **errp) | ||
75 | { | ||
76 | diff --git a/util/async.c b/util/async.c | ||
77 | index XXXXXXX..XXXXXXX 100644 | ||
78 | --- a/util/async.c | ||
79 | +++ b/util/async.c | ||
80 | @@ -XXX,XX +XXX,XX @@ static GSourceFuncs aio_source_funcs = { | ||
81 | |||
82 | GSource *aio_get_g_source(AioContext *ctx) | ||
83 | { | ||
84 | + aio_context_use_g_source(ctx); | ||
85 | g_source_ref(&ctx->source); | ||
86 | return &ctx->source; | ||
87 | } | ||
88 | -- | 57 | -- |
89 | 2.25.3 | 58 | 2.39.0 |
90 | 59 | ||
60 | diff view generated by jsdifflib |