On 28/09/15 22:08, Markus Armbruster wrote:
> Several devices don't survive object_unref(object_new(T)): they crash
> or hang during cleanup, or they leave dangling pointers behind.
>
> This breaks at least device-list-properties, because
> qmp_device_list_properties() needs to create a device to find its
> properties. Broken in commit f4eb32b "qmp: show QOM properties in
> device-list-properties", v2.1. Example reproducer:
>
> $ qemu-system-aarch64 -nodefaults -display none -machine none -S -qmp
> stdio
> {"QMP": {"version": {"qemu": {"micro": 50, "minor": 4, "major": 2},
> "package": ""}, "capabilities": []}}
> { "execute": "qmp_capabilities" }
> {"return": {}}
> { "execute": "device-list-properties", "arguments": { "typename":
> "pxa2xx-pcmcia" } }
> qemu-system-aarch64: /home/armbru/work/qemu/memory.c:1307:
> memory_region_finalize: Assertion `((&mr->subregions)->tqh_first == ((void
> *)0))' failed.
> Aborted (core dumped)
> [Exit 134 (SIGABRT)]
>
> Unfortunately, I can't fix the problems in these devices right now.
> Instead, add DeviceClass member cannot_even_create_with_object_new_yet
> to mark them:
>
> * Hang during cleanup (didn't debug, so I can't say why):
> "realview_pci", "versatile_pci", "s390-sclp-event-facility", "sclp"
>
> * Dangling pointer in cpus: most CPUs, plus "allwinner-a10", "digic",
> "fsl,imx25", "fsl,imx31", "xlnx,zynqmp", because they create such
> CPUs
>
> * Dangling pointers in QOM: "cgthree", "cuda", "integrator_debug",
> "macio-oldworld", "macio-newworld", "pxa2xx-fir", "pxa2xx-pcmcia",
> "SUNW,tcx"
>
> * Assert kvm_enabled(): "host-x86_64-cpu", host-i386-cpu",
> "host-powerpc64-cpu", "host-embedded-powerpc-cpu",
> "host-powerpc-cpu" (the powerpc ones can't currently reach the
> assertion, because the CPUs are only registered when KVM is enabled,
> but the assertion is arguably in the wrong place all the same)
>
> Make qmp_device_list_properties() fail cleanly when the device is so
> marked. This improves device-list-properties from "crashes, hangs or
> leaves dangling pointers behind" to "fails". Not a complete fix, just
> a better-than-nothing work-around. In the above reproducer,
> device-list-properties now fails with "Can't list properties of device
> 'pxa2xx-pcmcia'".
>
> This also protects -device FOO,help, which uses the same machinery
> since commit ef52358 "qdev-monitor: include QOM properties in -device
> FOO, help output", v2.2. Example reproducer:
>
> $ qemu-system-aarch64 -machine none -device pxa2xx-pcmcia,help
>
> Before:
>
> qemu-system-aarch64: .../memory.c:1307: memory_region_finalize: Assertion
> `((&mr->subregions)->tqh_first == ((void *)0))' failed.
>
> After:
>
> Can't list properties of device 'pxa2xx-pcmcia'
...
> static const TypeInfo xtensa_cpu_type_info = {
> diff --git a/tests/device-introspect-test.c b/tests/device-introspect-test.c
> index a8950a1..11d5fea 100644
> --- a/tests/device-introspect-test.c
> +++ b/tests/device-introspect-test.c
> @@ -91,34 +91,6 @@ static void test_device_intro_abstract(void)
> qtest_end();
> }
>
> -static bool blacklisted(const char *type)
> -{
> - static const char *blacklist[] = {
> - /* create memory region without owner -> dangling pointer */
> - "cgthree", "cuda", "integrator_debug", "macio-oldworld",
> - "macio-newworld", "pxa2xx-fir", "pxa2xx-pcmcia",
> - "SUNW,tcx",
> - /* hang in object_unref(): */
> - "realview_pci", "versatile_pci", "s390-sclp-event-facility", "sclp",
> - /* create a CPU, thus use after free (see below): */
> - "allwinner-a10", "digic", "fsl,imx25", "fsl,imx31", "xlnx,zynqmp",
> - };
> - size_t len = strlen(type);
> - int i;
> -
> - if (len >= 4 && !strcmp(type + len - 4, "-cpu")) {
> - /* use after free: cpu_exec_init() saves CPUState in cpus */
> - return true;
> - }
> -
> - for (i = 0; i < ARRAY_SIZE(blacklist); i++) {
> - if (!strcmp(blacklist[i], type)) {
> - return true;
> - }
> - }
> - return false;
> -}
> -
> static void test_device_intro_concrete(void)
> {
> QList *types;
> @@ -132,9 +104,6 @@ static void test_device_intro_concrete(void)
> type = qdict_get_try_str(qobject_to_qdict(qlist_entry_obj(entry)),
> "name");
> g_assert(type);
> - if (blacklisted(type)) {
> - continue; /* FIXME broken device, skip */
> - }
> test_one_device(type);
> }
I'd also rather move this patch before patch 4/7 so you can get rid of
the temporary workaround.
Thomas
