aboutsummaryrefslogtreecommitdiff
path: root/qemu-char.c
AgeCommit message (Collapse)Author
2014-08-18Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Block pull request # gpg: Signature made Fri 15 Aug 2014 18:04:23 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/block-pull-request: (55 commits) qcow2: fix new_blocks double-free in alloc_refcount_block() image-fuzzer: Reduce number of generator functions in __init__ image-fuzzer: Add generators of L1/L2 tables image-fuzzer: Add fuzzing functions for L1/L2 table entries docs: Expand the list of supported image elements with L1/L2 tables image-fuzzer: Public API for image-fuzzer/runner/runner.py image-fuzzer: Generator of fuzzed qcow2 images image-fuzzer: Fuzzing functions for qcow2 images image-fuzzer: Tool for fuzz tests execution docs: Specification for the image fuzzer ide: only constrain read/write requests to drive size, not other types virtio-blk: Correct bug in support for flexible descriptor layout libqos: Change free function called in malloc libqos: Correct mask to align size to PAGE_SIZE in malloc-pc libqtest: add QTEST_LOG for debugging qtest testcases ide: Fix segfault when flushing a device that doesn't exist qemu-options: add missing -drive discard option to cmdline help parallels: 2TB+ parallels images support parallels: split check for parallels format in parallels_open parallels: replace tabs with spaces in block/parallels.c ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-15qemu-char: using qemu_set_nonblock() instead of fcntl(O_NONBLOCK)Gonglei
Technically, fcntl(soc, F_SETFL, O_NONBLOCK) is incorrect since it clobbers all other file flags. We can use F_GETFL to get the current flags, set or clear the O_NONBLOCK flag, then use F_SETFL to set the flags. Using the qemu_set_nonblock() wrapper. Signed-off-by: Wangxin <wangxinxin.wang@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-08-15don't use 'Yoda conditions'Gonglei
imitate nearby code about using '!value' or 'value == NULL' Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-08-06backends: Introduce chr-testdevPaolo Bonzini
From: Paolo Bonzini <pbonzini@redhat.com> chr-testdev enables a virtio serial channel to be used for guest initiated qemu exits. hw/misc/debugexit already enables guest initiated qemu exits, but only for PC targets. chr-testdev supports any virtio-capable target. kvm-unit-tests/arm is already making use of this backend. Currently there is a single command implemented, "q". It takes a (prefix) argument for the exit code, thus an exit is implemented by writing, e.g. "1q", to the virtio-serial port. It can be used as: $QEMU ... \ -device virtio-serial-device \ -device virtserialport,chardev=ctd -chardev testdev,id=ctd or, use: $QEMU ... \ -device virtio-serial-device \ -device virtconsole,chardev=ctd -chardev testdev,id=ctd to bind it to virtio-serial port0. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andrew Jones <drjones@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-25qemu-char: ignore flow control if a PTY's slave is not connectedPaolo Bonzini
After commit f702e62 (serial: change retry logic to avoid concurrency, 2014-07-11), guest boot hangs if the backend is an unconnected PTY. The reason is that PTYs do not support G_IO_HUP, and serial_xmit is never called. To fix this, simply invoke serial_xmit immediately (via g_idle_source_new) when this happens. Tested-by: Pavel Hrdina <phrdina@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14qemu-char: fix deadlock with "-monitor pty"Paolo Bonzini
qemu_chr_be_generic_open cannot be called with the write lock taken, because it calls client code that may call qemu_chr_fe_write. This actually happens for the monitor: 0x00007ffff27dbf79 in __GI_raise (sig=sig@entry=6) 0x00007ffff27df388 in __GI_abort () 0x00005555555ef489 in error_exit (err=<optimized out>, msg=msg@entry=0x5555559796d0 <__func__.5959> "qemu_mutex_lock") 0x00005555558f9080 in qemu_mutex_lock (mutex=mutex@entry=0x555556248a30) 0x0000555555713936 in qemu_chr_fe_write (s=0x555556248a30, buf=buf@entry=0x5555563d8870 "QEMU 2.0.90 monitor - type 'help' for more information\r\n", len=56) 0x00005555556217fd in monitor_flush_locked (mon=mon@entry=0x555556251fd0) 0x0000555555621a12 in monitor_flush_locked (mon=0x555556251fd0) monitor_puts (mon=mon@entry=0x555556251fd0, str=0x55555634bfa7 "", str@entry=0x55555634bf70 "QEMU 2.0.90 monitor - type 'help' for more information\n") 0x0000555555624359 in monitor_vprintf (mon=0x555556251fd0, fmt=<optimized out>, ap=<optimized out>) 0x0000555555624414 in monitor_printf (mon=<optimized out>, fmt=fmt@entry=0x5555559105a0 "QEMU %s monitor - type 'help' for more information\n") 0x0000555555629806 in monitor_event (opaque=0x555556251fd0, event=<optimized out>) 0x000055555571343c in qemu_chr_be_generic_open (s=0x555556248a30) To avoid this, defer the call to an idle callback, which will be called as soon as the main loop is re-entered. In order to simplify the cleanup and do it in one place only, change pty_chr_close to call pty_chr_state. To reproduce, run with "-monitor pty", then try to read from the slave /dev/pts/FOO that it creates. Fixes: 9005b2a7589540a3733b3abdcfbccfe7746cd1a1 Reported-by: Li Liang <liangx.z.li@intel.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-06qemu-char: add chr_add_watch support in mux chardevKirill Batuzov
Forward chr_add_watch call from mux chardev to underlying implementation. This should fix bug #1335444 Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06Handle G_IO_HUP in tcp_chr_read for tcp chardevKirill Batuzov
Since commit cdaa86a54b232572bba594bf87a7416e527e460c ("Add G_IO_HUP handler for socket chardev") GLib limitation results in a bug on Windows host. Steps to reproduce: Start qemu: qemu-system-i386 -qmp tcp:127.0.0.1:4444:server:nowait Connect with telnet: telnet 127.0.0.1 4444 Try sending some data from telnet. Expected result: answers from QEMU. Observed result: no answers (actually tcp_chr_read is not called at all). Due to GLib limitations it is not possible to create several watches on one channel on Windows hosts. See bug #338943 in GNOME bugzilla for details: https://bugzilla.gnome.org/show_bug.cgi?id=338943 This reimplements commit cdaa86a54b232572bba594bf87a7416e527e460c ("Add G_IO_HUP handler for socket chardev") using a single watch: Handle G_IO_HUP in tcp_chr_read instead. It is already watched by a corresponding watch. Remove the second watch with its handler. Cc: Antonios Motakis <a.motakis@virtualopensystems.com> Cc: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Signed-off-by: Nikita Belov <zodiac@ispras.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-27char: report frontend open/closed state in 'query-chardev'Laszlo Ersek
In addition to the on-line reporting added in the previous patch, allow libvirt to query frontend state independently of events. Libvirt's path to identify the guest agent channel it cares about differs between the event added in the previous patch and the QMP response field added here. The event identifies the frontend device, by "id". The 'query-chardev' QMP command identifies the backend device (again by "id"). The association is under libvirt's control. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1080376 Reviewed-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-06-26qemu-char: initialize chr_write_lockPaolo Bonzini
Otherwise, Windows fails with a deadlock. Reported-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1403679897-11480-1-git-send-email-pbonzini@redhat.com Tested-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-26qemu-char: fix warning 'res' may be used uninitializedIgor Mammedov
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-id: 1403683241-20678-1-git-send-email-imammedo@redhat.com Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-24Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into stagingPeter Maydell
* remotes/qmp-unstable/queue/qmp: (43 commits) monitor: protect event emission monitor: protect outbuf and mux_out with mutex qemu-char: make writes thread-safe qemu-char: move pty_chr_update_read_handler around qemu-char: do not call chr_write directly qemu-char: introduce qemu_chr_alloc qapi event: clean up qapi event: convert QUORUM events qapi event: convert GUEST_PANICKED qapi event: convert BALLOON_CHANGE qmp: convert ACPI_DEVICE_OST event qapi event: convert SPICE events qapi event: convert VNC events qapi event: convert NIC_RX_FILTER_CHANGED qapi event: convert other BLOCK_JOB events qapi event: convert BLOCK_IMAGE_CORRUPTED qapi event: convert BLOCK_IO_ERROR and BLOCK_JOB_ERROR qapi event: convert DEVICE_TRAY_MOVED qapi event: convert DEVICE_DELETED qapi event: convert WATCHDOG ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-23qemu-char: make writes thread-safePaolo Bonzini
This will let threads other than the I/O thread raise QMP events. GIOChannel is thread-safe, and send and receive state is usually well-separated. The only driver that requires some care is the pty driver, where some of the state is shared by the read and write sides. That state is protected with the chr_write_lock too. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-06-23qemu-char: move pty_chr_update_read_handler aroundPaolo Bonzini
Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-06-23qemu-char: do not call chr_write directlyPaolo Bonzini
Make the mux always go through qemu_chr_fe_write, so that we'll get the mutex for the underlying chardev. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-06-23qemu-char: introduce qemu_chr_allocPaolo Bonzini
The next patch will modify this function to initialize state that is common to all backends. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-06-23qemu-char: avoid leaking unused fds in tcp_get_msgfds()Stefan Hajnoczi
Commit c76bf6bb8fbbb233a7d3641e09229d23747d5ee3 ("Add chardev API qemu_chr_fe_get_msgfds") extended the get_msgfds API from one to multiple file descriptors. It forgot to close unused file descriptors before freeing the file descriptor array. This patch prevents a file descriptor leak if the tcp_get_msgfds() callers requests fewer file descriptors than are available. Cc: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-23qemu-char: fix qemu_chr_fe_get_msgfd()Stefan Hajnoczi
Commit c76bf6bb8fbbb233a7d3641e09229d23747d5ee3 ("Add chardev API qemu_chr_fe_get_msgfds") broke qemu_chr_fe_get_msgfd() because it changed the return value. Callers expect -1 if no fd is available. The commit changed the return value to 0 (which is a valid file descriptor number) so callers always detected a file descriptor even if none was available. This patch fixes qemu-iotests 045: $ cd tests/qemu-iotests && ./check 045 [...] +FAIL: test_add_fd_invalid_fd (__main__.TestFdSets) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "./045", line 123, in test_add_fd_invalid_fd + self.assert_qmp(result, 'error/class', 'GenericError') + File "/home/stefanha/qemu/tests/qemu-iotests/iotests.py", line 232, in assert_qmp + result = self.dictpath(d, path) + File "/home/stefanha/qemu/tests/qemu-iotests/iotests.py", line 211, in dictpath + self.fail('failed path traversal for "%s" in "%s"' % (path, str(d))) +AssertionError: failed path traversal for "error/class" in "{u'return': {u'fdset-id': 2, u'fd': 0}}" Cc: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-23console: move chardev declarations to sysemu/char.hMichael S. Tsirkin
move generic chardev APIs to sysemu/char.h, to make them available to callers which can not depend on the whole of ui/console.h. This fixes a build error on systems without pixman-devel: ./configure --disable-tools --disable-docs --target-list=arm-linux-user ... pixman none ... make ... In file included from /data/home/nchip/linaro/qemu/include/ui/console.h:4:0, from /data/home/nchip/linaro/qemu/stubs/vc-init.c:2: /data/home/nchip/linaro/qemu/include/ui/qemu-pixman.h:14:20: fatal error: pixman.h: No such file or directory #include <pixman.h> ^ compilation terminated. Reported-by: Riku Voipio <riku.voipio@iki.fi> Tested-by: Riku Voipio <riku.voipio@iki.fi> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1403508500-32691-1-git-send-email-mst@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-19Add G_IO_HUP handler for socket chardevNikolay Nikolaev
This is used to detect that the remote end has disconnected. Just call tcp_char_disconnect on receiving this event. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19Add chardev API qemu_chr_fe_get_msgfdsNikolay Nikolaev
This extends the existing qemu_chr_fe_get_msgfd by allowing to read a set of fds. The function for receiving the fds - unix_process_msgfd is extended to allocate the needed array size. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19Add chardev API qemu_chr_fe_set_msgfdsNikolay Nikolaev
This will set an array of file descriptors to the internal structures. The next time a message is send the array will be send as ancillary data. This feature works on the UNIX domain socket backend only. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19Add chardev API qemu_chr_fe_read_allNikolay Nikolaev
This function will attempt to read data from the chardev trying to fill the buffer up to the given length. Add tcp_chr_disconnect to reuse disconnection code where needed. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-13char: fix avail_connections init in qemu_chr_open_eventfd()David Marchand
When trying to use a ivshmem server with qemu, ivshmem init code tries to create a CharDriverState object for each eventfd retrieved from the server. To create this object, a call to qemu_chr_open_eventfd() is done. Right after this, before adding a frontend, qemu_chr_fe_claim_no_fail() is called. qemu_chr_open_eventfd() does not set avail_connections to 1, so no frontend can be associated because qemu_chr_fe_claim_no_fail() makes qemu stop right away. This problem comes from 456d60692310e7ac25cf822cc1e98192ad636ece "qemu-char: Call fe_claim / fe_release when not using qdev chr properties". Fix this, by setting avail_connections to 1 in qemu_chr_open_eventfd(). Signed-off-by: David Marchand <david.marchand@6wind.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-06-11monitor: Add ringbuf_write and ringbuf_read argument completionHani Benhabiles
Export chr_is_ringbuf() function. Also remove left-over function prototypes while at it. Signed-off-by: Hani Benhabiles <hani@linux.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-05-21char: Explain qmp_chardev_add()'s unusual error handlingMarkus Armbruster
Character backend open hasn't been fully converted to the Error API. Some opens fail without setting an error. qmp_chardev_add() needs to detect when that happens, and set a generic error. Explain that in a comment, and inline error_is_set() for clarity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-21char: Clean up fragile use of error_is_set()Markus Armbruster
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). The error_is_set(errp) in qemu_chr_new_from_opts() is merely fragile, because the callers never pass a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-21char: Use return values instead of error_is_set(errp)Markus Armbruster
Using error_is_set(errp) to check whether a function call failed is fragile: it breaks when errp is null. Check perfectly suitable return values instead when possible. As far as I can tell, errp can't be null there, but this is more robust and more obviously correct Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-03-13char: restore read callback on a reattached (hotplug) chardevGal Hammer
Fix a bug that was introduced in commit 386a5a1e. A removal of a device set the chr handlers to NULL. However when the device is plugged back, its read callback is not restored so data can't be transferred from the host to the guest (e.g. via the virtio-serial port). https://bugzilla.redhat.com/show_bug.cgi?id=1027181 Signed-off-by: Gal Hammer <ghammer@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-02-17qmp: expose list of supported character device backendsMartin Kletzander
Introduce 'query-chardev-backends' QMP command which lists all supported character device backends. Signed-off-by: Martin Kletzander <mkletzan@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-02-17Use error_is_set() only when necessaryMarkus Armbruster
error_is_set(&var) is the same as var != NULL, but it takes whole-program analysis to figure that out. Unnecessarily hard for optimizers, static checkers, and human readers. Dumb it down to obvious. Gets rid of several dozen Coverity false positives. Note that the obvious form is already used in many places. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2013-12-23misc: Use macro ARRAY_SIZE where possibleStefan Weil
This improves readability and simplifies the code. Cc: Anthony Liguori <aliguori@amazon.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-12-16char: add qemu_chr_fe_event()Marc-André Lureau
Teach the chardev frontend to send event. This is used by the Spice port chardev currently. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-10-10Merge remote-tracking branch 'amit/char-remove-watch-on-unplug' into stagingAnthony Liguori
# By Amit Shah # Via Amit Shah * amit/char-remove-watch-on-unplug: char: remove watch callback on chardev detach from frontend char: use common function to disable callbacks on chardev close char: move backends' io watch tag to CharDriverState Message-id: 20131004154802.GA25646@grmbl.mre Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-10-09Merge remote-tracking branch 'mjt/trivial-patches' into stagingAnthony Liguori
# By Stefan Weil (5) and others # Via Michael Tokarev * mjt/trivial-patches: migration: Fix compiler warning ('caps' may be used uninitialized) util/path: Fix type which is longer than 8 bit for MinGW hw/9pfs: Fix errno value for xattr functions vl: Clean up unnecessary boot_order complications qemu-char: Fix potential out of bounds access to local arrays pci-ohci: Add missing 'break' in ohci_service_td sh4: Fix serial line access for Linux kernels later than 3.2 hw/alpha: Fix compiler warning (integer constant is too large) target-i386: Fix compiler warning (integer constant is too large) block: Remove unused assignment (fixes warning from clang) exec: cleanup DEBUG_SUBPAGE tests: Fix schema parser test for in-tree build tests: Update .gitignore for test-int128 and test-bitops .gitignore: ignore tests/qemu-iotests/socket_scm_helper Message-id: 1381051979-25742-1-git-send-email-mjt@msgid.tls.msk.ru Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-10-05qemu-char: Fix potential out of bounds access to local arraysStefan Weil
Latest gcc-4.8 supports a new option -fsanitize=address which activates an AddressSanitizer. This AddressSanitizer stops the QEMU system emulation very early because two character arrays of size 8 are potentially written with 9 bytes. Commit 6ea314d91439741e95772dfbab98b4135e04bebb added the code. There is no obvious reason why width or height could need 8 characters, so reduce it to 7 characters which together with the terminating '\0' fit into the arrays. Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Alex Bennée <alex@bennee.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-10-01chardev: handle qmp_chardev_add(KIND_MUX) failureGerd Hoffmann
Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-09-12chardev: fix pty_chr_timerGerd Hoffmann
pty_chr_timer first calls pty_chr_update_read_handler(), then clears timer_tag (because it is a one-shot timer). This is the wrong order though. pty_chr_update_read_handler might re-arm time timer, and the new timer_tag gets overwitten in that case. This leads to crashes when unplugging a pty chardev: pty_chr_close thinks no timer is running -> timer isn't canceled -> pty_chr_timer gets called with stale CharDevState -> BOOM. This patch fixes the ordering. Kill the pointless goto while being at it. https://bugzilla.redhat.com/show_bug.cgi?id=994414 Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-09-05char: remove watch callback on chardev detach from frontendAmit Shah
If a frontend device releases the chardev (via unplug), the chr handlers are set to NULL via qdev's exit callbacks invoking qemu_chr_add_handlers(). If the chardev had a pending operation, a callback will be invoked, which will try to access data in the just-released frontend, causing a segfault. Ensure the callbacks are disabled when frontends release chardevs. This was seen when a virtio-serial port was unplugged when heavy guest->host IO was in progress (causing a callback to be registered). In the window in which the throttling was active, unplugging ports caused a qemu segfault. https://bugzilla.redhat.com/show_bug.cgi?id=985205 CC: <qemu-stable@nongnu.org> Reported-by: Sibiao Luo <sluo@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2013-09-05char: use common function to disable callbacks on chardev closeAmit Shah
This deduplicates code used a lot of times. CC: <qemu-stable@nongnu.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2013-09-05char: move backends' io watch tag to CharDriverStateAmit Shah
All the backends implement an io watcher tag for callbacks. Move it to CharDriverState from each backend's struct to make accessing the tag from backend-neutral functions easier. This will be used later to cancel a callback on chardev detach from a frontend. CC: <qemu-stable@nongnu.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
2013-08-26Merge remote-tracking branch 'stefanha/block' into stagingAnthony Liguori
# By Alex Bligh (32) and others # Via Stefan Hajnoczi * stefanha/block: (42 commits) win32-aio: drop win32_aio_flush_cb() aio-win32: replace incorrect AioHandler->opaque usage with ->e aio / timers: remove dummy_io_handler_flush from tests/test-aio.c aio / timers: Remove legacy interface aio / timers: Switch entire codebase to the new timer API aio / timers: Add scripts/switch-timer-api aio / timers: Add test harness for AioContext timers aio / timers: convert block_job_sleep_ns and co_sleep_ns to new API aio / timers: Convert rtc_clock to be a QEMUClockType aio / timers: Remove main_loop_timerlist aio / timers: Rearrange timer.h & make legacy functions call non-legacy aio / timers: Add qemu_clock_get_ms and qemu_clock_get_ms aio / timers: Remove legacy qemu_clock_deadline & qemu_timerlist_deadline aio / timers: Remove alarm timers aio / timers: Add documentation and new format calls aio / timers: Use all timerlists in icount warp calculations aio / timers: Introduce new API timer_new and friends aio / timers: On timer modification, qemu_notify or aio_notify aio / timers: Convert mainloop to use timeout aio / timers: Convert aio_poll to use AioContext timers' deadline ... Message-id: 1377202298-22896-1-git-send-email-stefanha@redhat.com Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
2013-08-22aio / timers: Switch entire codebase to the new timer APIAlex Bligh
This is an autogenerated patch using scripts/switch-timer-api. Switch the entire code base to using the new timer API. Note this patch may introduce some line length issues. Signed-off-by: Alex Bligh <alex@alex.org.uk> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2013-08-20Convert stderr message calling error_get_pretty() to error_report()Seiji Aguchi
Convert stderr messages calling error_get_pretty() to error_report(). Timestamp is prepended by -msg timstamp option with it. Per Markus's comment below, A conversion from fprintf() to error_report() is always an improvement, regardless of error_get_pretty(). http://marc.info/?l=qemu-devel&m=137513283408601&w=2 But, it is not reasonable to convert them at one time because fprintf() is used everwhere in qemu. So, it should be done step by step with avoiding regression. Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2013-08-13qemu-char: fix infinite recursion connecting to monitor ptyJames Hogan
Since commit bd5c51e (qemu-char: don't issue CHR_EVENT_OPEN in a BH), an infinite recursion occurs when putting the monitor on a pty (-monitor pty) and connecting a terminal to the slave port. This is because of the qemu_chr_be_event(s, CHR_EVENT_OPENED) added to qemu_chr_be_generic_open(). This event is captured by monitor_event() which prints a welcome message to the character device. The flush of that welcome message retriggers another open event in pty_chr_state() because it checks s->connected, but only sets it to 1 after calling qemu_chr_be_generic_open(). I've fixed this by setting s->connected = 1 before the call to qemu_chr_be_generic_open() instead of after, so that the recursive pty_chr_state() doesn't call it again. An example snippet of repeating backtrace: ... #107486 0x007aec58 in monitor_flush (mon=0xf418b0) at qemu/monitor.c:288 #107487 0x007aee7c in monitor_puts (mon=0xf418b0, str=0x1176d07 "") at qemu/monitor.c:322 #107488 0x007aef20 in monitor_vprintf (mon=0xf418b0, fmt=0x8d4820 "QEMU %s monitor - type 'help' for more information\n", ap=0x7f432be0) at qemu/monitor.c:339 #107489 0x007aefac in monitor_printf (mon=0xf418b0, fmt=0x8d4820 "QEMU %s monitor - type 'help' for more information\n") at qemu/monitor.c:347 #107490 0x007ba4bc in monitor_event (opaque=0xf418b0, event=2) at qemu/monitor.c:4699 #107491 0x00684c28 in qemu_chr_be_event (s=0xf37788, event=2) at qemu/qemu-char.c:108 #107492 0x00684c70 in qemu_chr_be_generic_open (s=0xf37788) at qemu/qemu-char.c:113 #107493 0x006880a4 in pty_chr_state (chr=0xf37788, connected=1) at qemu/qemu-char.c:1145 #107494 0x00687fa4 in pty_chr_update_read_handler (chr=0xf37788) at qemu/qemu-char.c:1121 #107495 0x00687c9c in pty_chr_write (chr=0xf37788, buf=0x70b3c008 <Address 0x70b3c008 out of bounds>, len=538720) at qemu/qemu-char.c:1063 #107496 0x00684cc4 in qemu_chr_fe_write (s=0xf37788, buf=0x70b3c008 <Address 0x70b3c008 out of bounds>, len=538720) at qemu/qemu-char.c:118 ... Signed-off-by: James Hogan <james.hogan@imgtec.com> Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com> Message-id: 1375960178-10882-1-git-send-email-james.hogan@imgtec.com Cc: Michael Roth <mdroth@linux.vnet.ibm.com> Cc: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-30chardev: fix CHR_EVENT_OPENED events for mux chardevsMichael Roth
As of bd5c51ee6c4f1c79cae5ad2516d711a27b4ea8ec, chardevs no longer use bottom-halves to issue CHR_EVENT_OPENED events. To maintain past semantics, we instead defer the CHR_EVENT_OPENED events toward the end of chardev initialization. For muxes, this isn't good enough, since a range of FEs must be able to attach to the mux prior to any CHR_EVENT_OPENED being issued, else each FE will immediately print it's initial output (prompts, banners, etc.) just prior to us switching to the next FE as part of initialization. The is new and confusing behavior for users, as they'll see output for things like the HMP monitor, even though their the current mux focus may be a guest serial port with potentially no output. We fix this by further deferring CHR_EVENT_OPENED events for FEs associated with muxes until after machine init by flagging mux chardevs with 'explicit_be_open', which suppresses emission of CHR_EVENT_OPENED events until we explicitly set the mux as opened later. Currently, we must defer till after machine init since we potentially associate FEs with muxes as part of realize (for instance, serial_isa_realizefn). Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Message-id: 1375207462-8141-1-git-send-email-mdroth@linux.vnet.ibm.com Cc: qemu-stable@nongnu.org Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-29qapi: Rename ChardevBackend member "memory" to "ringbuf"Markus Armbruster
Commit 1da48c6 called the new member "memory" after commit 3949e59 standardized "ringbuf". Rename for consistency. However, member name "memory" is visible in QMP since 1.5. It's undocumented just like the driver name. Keep it working anyway. Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1374849874-25531-4-git-send-email-armbru@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-29qemu-char: Register ring buffer driver with correct name "ringbuf"Markus Armbruster
The driver is new in 1.4, with the documented name "ringbuf". However, it's actual name is the completely undocumented "memory". Screwed up in commit 3949e59. Fix code to match documentation. Keep the undocumented name working as an alias for compatibility. Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1374849874-25531-3-git-send-email-armbru@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-29Revert "chardev: Make the name of memory device consistent"Markus Armbruster
This reverts commit 6a85e60cb994bd95d1537aafbff65816f3de4637. Commit 51767e7 "qemu-char: Add new char backend CirMemCharDriver" introduced a memory ring buffer character device driver named "memory". Commit 3949e59 "qemu-char: Saner naming of memchar stuff & doc fixes" changed the driver name to "ringbuf", along with a whole bunch of other names, with the following rationale: Naming is a mess. The code calls the device driver CirMemCharDriver, the public API calls it "memory", "memchardev", or "memchar", and the special commands are named like "memchar-FOO". "memory" is a particularly unfortunate choice, because there's another character device driver called MemoryDriver. Moreover, the device's distinctive property is that it's a ring buffer, not that's in memory. This is what we released in 1.4.0. Unfortunately, the rename missed a critical instance of "memory": the actual driver name. Thus, the new device could be used only by an entirely undocumented name. The documented name did not work. Bummer. Commit 6a85e60 fixes this by changing the documentation to match the code. It also changes some, but not all related occurences of "ringbuf" to "memory". Left alone are identifiers in C code, HMP and QMP commands. The latter are external interface, so they can't be changed. The result is an inconsistent mess. Moreover, "memory" is a rotten name. The device's distinctive property is that it's a ring buffer, not that's in memory. User's don't care whether it's in RAM, flash, or carved into chocolate tablets by Oompa Loompas. Revert the commit. Next commit will fix just the bug. Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1374849874-25531-2-git-send-email-armbru@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-18char: io_channel_send: don't lose written bytesLaszlo Ersek
The g_io_channel_write_chars() documentation states, bytes_written: The number of bytes written. This can be nonzero even if the return value is not G_IO_STATUS_NORMAL. [...] io_channel_send() could lose such bytes before. Furthermore, the (status == G_IO_STATUS_EOF) condition used to evaluate to constant false whenever it was reached. When that condition actually held, it always led to -1 / EINVAL. This patch (almost) distinguishes G_IO_STATUS_EOF only when no bytes have been written, and then treats it as an error. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> Message-id: 1373998781-29561-2-git-send-email-lersek@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 11:06:12 +0000