Re: [Qemu-devel] Error handling in realize() methods

Laszlo Ersek writes: > I've been following this discussion with great interest. > > My opinion should not be considered, because I won't be turning my > opinion into new code, or an agreement to support / maintain code. :) > > My opinion is that > - every single allocation

Re: [Qemu-devel] Error handling in realize() methods

"Dr. David Alan Gilbert" writes: > * Markus Armbruster (arm...@redhat.com) wrote: >> "Dr. David Alan Gilbert" writes: >> >> > * Markus Armbruster (arm...@redhat.com) wrote: >> >> In general, code running withing a realize() method should not exit() on

Re: [Qemu-devel] Error handling in realize() methods

* Markus Armbruster (arm...@redhat.com) wrote: > Paolo Bonzini writes: > > > On 09/12/2015 10:30, Markus Armbruster wrote: > >> My current working assumption is that passing _fatal to > >> memory_region_init_ram() & friends is okay even in realize() methods and > >> their

Re: [Qemu-devel] Error handling in realize() methods

On 10/12/2015 12:06, Markus Armbruster wrote: > Paolo Bonzini writes: > >> On 09/12/2015 10:30, Markus Armbruster wrote: >>> My current working assumption is that passing _fatal to >>> memory_region_init_ram() & friends is okay even in realize() methods and >>> their

Re: [Qemu-devel] Error handling in realize() methods

Paolo Bonzini writes: > On 10/12/2015 12:06, Markus Armbruster wrote: >> Paolo Bonzini writes: >> >>> On 09/12/2015 10:30, Markus Armbruster wrote: My current working assumption is that passing _fatal to memory_region_init_ram() & friends is

Re: [Qemu-devel] Error handling in realize() methods

Paolo Bonzini writes: > On 09/12/2015 10:30, Markus Armbruster wrote: >> My current working assumption is that passing _fatal to >> memory_region_init_ram() & friends is okay even in realize() methods and >> their supporting code, except when the allocation can be large. > >

Re: [Qemu-devel] Error handling in realize() methods

On 12/10/15 10:22, Markus Armbruster wrote: > Laszlo Ersek writes: > >> I've been following this discussion with great interest. >> >> My opinion should not be considered, because I won't be turning my >> opinion into new code, or an agreement to support / maintain code. :) >>

Re: [Qemu-devel] Error handling in realize() methods

On 10/12/2015 12:21, Dr. David Alan Gilbert wrote: > I guess the use of abort() could tell us > that - however it's a really big assumption that in an OOM case we'd > be able to dump the information. If it's not OOM, but just a multi-gigabyte allocation, we should. Paolo

Re: [Qemu-devel] Error handling in realize() methods

"Dr. David Alan Gilbert" writes: > * Markus Armbruster (arm...@redhat.com) wrote: >> In general, code running withing a realize() method should not exit() on >> error. Instad, errors should be propagated through the realize() >> method. Additionally, the realize() method

Re: [Qemu-devel] Error handling in realize() methods

* Markus Armbruster (arm...@redhat.com) wrote: > "Dr. David Alan Gilbert" writes: > > > * Markus Armbruster (arm...@redhat.com) wrote: > >> In general, code running withing a realize() method should not exit() on > >> error. Instad, errors should be propagated through the

Re: [Qemu-devel] Error handling in realize() methods

On 9 December 2015 at 10:29, Dr. David Alan Gilbert wrote: > (OK, to be honest I think we should protect every allocation - but I do > have sympathy with the complexity/testing arguments). My view on this is that Linux overcommits, so the actual likely way that "oops, out of

Re: [Qemu-devel] Error handling in realize() methods

* Peter Maydell (peter.mayd...@linaro.org) wrote: > On 9 December 2015 at 10:29, Dr. David Alan Gilbert > wrote: > > (OK, to be honest I think we should protect every allocation - but I do > > have sympathy with the complexity/testing arguments). > > My view on this is that

Re: [Qemu-devel] Error handling in realize() methods

* Paolo Bonzini (pbonz...@redhat.com) wrote: > > > On 09/12/2015 10:30, Markus Armbruster wrote: > > My current working assumption is that passing _fatal to > > memory_region_init_ram() & friends is okay even in realize() methods and > > their supporting code, except when the allocation can be

Re: [Qemu-devel] Error handling in realize() methods

On 09/12/2015 10:30, Markus Armbruster wrote: > My current working assumption is that passing _fatal to > memory_region_init_ram() & friends is okay even in realize() methods and > their supporting code, except when the allocation can be large. I suspect a lot of memory_region_init_ram()s could

Re: [Qemu-devel] Error handling in realize() methods

On 12/09/15 11:29, Dr. David Alan Gilbert wrote: > * Markus Armbruster (arm...@redhat.com) wrote: >> "Dr. David Alan Gilbert" writes: >> >>> * Markus Armbruster (arm...@redhat.com) wrote: In general, code running withing a realize() method should not exit() on

Re: [Qemu-devel] Error handling in realize() methods

On 12/09/15 12:47, Peter Maydell wrote: > On 9 December 2015 at 10:29, Dr. David Alan Gilbert > wrote: >> (OK, to be honest I think we should protect every allocation - but I do >> have sympathy with the complexity/testing arguments). > > My view on this is that Linux

Re: [Qemu-devel] Error handling in realize() methods

On 09/12/2015 14:12, Dr. David Alan Gilbert wrote: >> > Even if we don't, we should use _abort, not _fatal >> > (programmer error---due to laziness---rather than user error). >> > _fatal should really be restricted to code that is running very >> > close to main(). > No, we used to have

Re: [Qemu-devel] Error handling in realize() methods

* Markus Armbruster (arm...@redhat.com) wrote: > In general, code running withing a realize() method should not exit() on > error. Instad, errors should be propagated through the realize() > method. Additionally, the realize() method should fail cleanly, > i.e. carefully undo its side effects

[Qemu-devel] Error handling in realize() methods

In general, code running withing a realize() method should not exit() on error. Instad, errors should be propagated through the realize() method. Additionally, the realize() method should fail cleanly, i.e. carefully undo its side effects such as wiring of interrupts, mapping of memory, and so