Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 13 3月, 2015 9 次提交
    • P
      Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150312-2' into staging · dea46359
      由 Peter Maydell 提交于 
      misc ui patches, mostly sdl related.

# gpg: Signature made Thu Mar 12 14:51:07 2015 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-sdl-20150312-2:
  pixman: add a bunch of PIXMAN_BE_* defines for 32bpp
  Allow the use of X11 from a non standard location.
  configure: opengl overhaul
  sdl: Fix crash when calling sdl_switch() with NULL surface
  sdl: Refresh debug statements
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      dea46359
    • P
      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging · f3dd251d
      由 Peter Maydell 提交于 
      Update OpenBIOS images

# gpg: Signature made Fri Mar 13 11:04:07 2015 GMT using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

* remotes/mcayland/tags/qemu-openbios-signed:
  Update OpenBIOS images
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      f3dd251d
    • M
      Update OpenBIOS images · 09c0772b
      由 Mark Cave-Ayland 提交于 
      Update OpenBIOS images to SVN r1334 built from submodule.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      09c0772b
    • P
      Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging · 82389dcc
      由 Peter Maydell 提交于 
      # gpg: Signature made Thu Mar 12 20:06:50 2015 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/net-pull-request:
  tests: rtl8139: test timers and interrupt
  net: synchronize net_host_device_remove with host_net_remove_completion
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      82389dcc
    • P
      Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging · f9f141b7
      由 Peter Maydell 提交于 
      # gpg: Signature made Thu Mar 12 19:09:26 2015 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request:
  qcow2: fix the macro QCOW_MAX_L1_SIZE's use
  queue: fix QSLIST_INSERT_HEAD_ATOMIC race
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      f9f141b7
    • F
      tests: rtl8139: test timers and interrupt · 069bb583
      由 Frediano Ziglio 提交于 
      Test behaviour of timers and interrupts related to timeouts.
Signed-off-by: NFrediano Ziglio <freddy77@gmail.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1420742303-3030-1-git-send-email-freddy77@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      069bb583
    • P
      net: synchronize net_host_device_remove with host_net_remove_completion · 7fb43911
      由 Paolo Bonzini 提交于 
      Using net_host_check_device is unnecessary.  qemu_del_net_client asserts
for the non-peer case that it can only process NIC type NetClientStates,
and that assertion is valid for the peered case as well, so move it and
use the same check in net_host_device_remove.  host_net_remove_completion
is already checking the type.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NJason Wang <jasowang@redhat.com>
Message-id: 1419353600-30519-2-git-send-email-pbonzini@redhat.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      7fb43911
    • W
      qcow2: fix the macro QCOW_MAX_L1_SIZE's use · 87b86e7e
      由 Wen Congyang 提交于 
      QCOW_MAX_L1_SIZE's unit is byte, and l1_size's unit
is l1 table entry size(8 bytes).
Signed-off-by: NWen Congyang <wency@cn.fujitsu.com>
Message-id: 54FFB0F1.5010307@cn.fujitsu.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      87b86e7e
    • P
      queue: fix QSLIST_INSERT_HEAD_ATOMIC race · 2120465f
      由 Paolo Bonzini 提交于 
      There is a not-so-subtle race in QSLIST_INSERT_HEAD_ATOMIC.

Because atomic_cmpxchg returns the old value instead of a success flag,
QSLIST_INSERT_HEAD_ATOMIC was checking for success by comparing against
the second argument to atomic_cmpxchg.  Unfortunately, this only works
if the second argument is a local or thread-local variable.

If it is in memory, it can be subject to common subexpression elimination
(and then everything's fine) or reloaded after the atomic_cmpxchg,
depending on the compiler's whims.  If the latter happens, the race can
happen.  A thread can sneak in, doing something on elm->field.sle_next
after the atomic_cmpxchg and before the comparison.  This causes a wrong
failure, and then two threads are using "elm" at the same time.  In the
case discovered by Christian, the sequence was likely something like this:

    thread 1                   | thread 2
    QSLIST_INSERT_HEAD_ATOMIC  |
      atomic_cmpxchg succeeds  |
      elm added to list        |
                               | steal release_pool
                               | QSLIST_REMOVE_HEAD
                               | elm removed from list
                               | ...
                               | QSLIST_INSERT_HEAD_ATOMIC
                               |   (overwrites sle_next)
      spurious failure         |
      atomic_cmpxchg succeeds  |
      elm added to list again  |
                               |
    steal release_pool         |
    QSLIST_REMOVE_HEAD         |
    elm removed again          |

The last three steps could be done by a third thread as well.
A reproducer that failed in a matter of seconds is as follows:

- the guest has 32 VCPUs on a 28 core host (hyperthreading was enabled),
  memory was 16G just to err on the safe side (the host has 64G, but hey
  at least you need no s390)

- the guest has 24 null-aio virtio-blk devices using dataplane
  (-object iothread,id=ioN -drive if=none,id=blkN,driver=null-aio,size=500G
  -device virtio-blk-pci,iothread=ioN,drive=blkN)

- the guest also has a single network interface.  It's only doing loopback
  tests so slirp vs. tap and the model doesn't matter.

- the guest is running fio with the following script:

     [global]
     rw=randread
     blocksize=16k
     ioengine=libaio
     runtime=10m
     buffered=0
     fallocate=none
     time_based
     iodepth=32

     [virtio1a]
     filename=/dev/block/252\:16

     [virtio1b]
     filename=/dev/block/252\:16

     ...

     [virtio24a]
     filename=/dev/block/252\:384

     [virtio24b]
     filename=/dev/block/252\:384

     [listen1]
     protocol=tcp
     ioengine=net
     port=12345
     listen
     rw=read
     bs=4k
     size=1000g

     [connect1]
     protocol=tcp
     hostname=localhost
     ioengine=net
     port=12345
     protocol=tcp
     rw=write
     startdelay=1
     size=1000g

     ...

     [listen8]
     protocol=tcp
     ioengine=net
     port=12352
     listen
     rw=read
     bs=4k
     size=1000g

     [connect8]
     protocol=tcp
     hostname=localhost
     ioengine=net
     port=12352
     rw=write
     startdelay=1
     size=1000g

Moral of the story: I should refrain from writing more clever stuff.
At least it looks like it is not too clever to be undebuggable.
Reported-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Tested-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1426002357-6889-1-git-send-email-pbonzini@redhat.com
Fixes: c740ad92Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      2120465f
  3. 12 3月, 2015 31 次提交