From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60447) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a6eXb-0001A6-1e for qemu-devel@nongnu.org; Wed, 09 Dec 2015 08:12:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a6eXX-0008Tx-P1 for qemu-devel@nongnu.org; Wed, 09 Dec 2015 08:12:18 -0500 Received: from mx1.redhat.com ([209.132.183.28]:41829) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a6eXX-0008Ts-Kf for qemu-devel@nongnu.org; Wed, 09 Dec 2015 08:12:15 -0500 Date: Wed, 9 Dec 2015 13:12:11 +0000 From: "Dr. David Alan Gilbert" Message-ID: <20151209131210.GA18106@work-vm> References: <87a8pl9hmt.fsf@blackfin.pond.sub.org> <20151208141938.GB2593@work-vm> <87io480y0n.fsf@blackfin.pond.sub.org> <566827FC.4080701@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <566827FC.4080701@redhat.com> Subject: Re: [Qemu-devel] Error handling in realize() methods List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: Peter Maydell , Peter Crosthwaite , Markus Armbruster , Andreas =?iso-8859-1?Q?F=E4rber?= , qemu-devel@nongnu.org * Paolo Bonzini (pbonzini@redhat.com) wrote: > > > On 09/12/2015 10:30, Markus Armbruster wrote: > > My current working assumption is that passing &error_fatal to > > memory_region_init_ram() & friends is okay even in realize() methods and > > their supporting code, except when the allocation can be large. > > I suspect a lot of memory_region_init_ram()s could be considered > potentially large (at least in the 16-64 megabytes range). Propagation > of memory_region_init_ram() failures is easy enough, thanks to Error**, > that we should just do it. > > Even if we don't, we should use &error_abort, not &error_fatal > (programmer error---due to laziness---rather than user error). > &error_fatal should really be restricted to code that is running very > close to main(). No, we used to have error_abort and changed them out for error_fatal because we were getting flooded with crash reports due to the aborts of people trying to run VMs too big for their machine. Dave > > Paolo > > > Even > > then, &error_fatal is better than buggy recovery code (which I can see > > all over the place, but that's a separate topic). -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK