[Qemu-devel] [PATCH v2 0/2] Enable passing pre-opened chardev socket FDs

[Qemu-devel] [PATCH v2 0/2] Enable passing pre-opened chardev socket FDs

[Daniel P. Berrange]

This fixes a long standing problem that libvirt has with starting up QEMU.

We have to busy-wait retrying connect() on the QMP monitor socket until QEMU
finally creates & listens on it, but at same time must be careful to not wait
forever if QEMU exits.

This this patch series, libvirt can simply pass in a pre-opened UNIX domain
socket file descriptor, which it can immediately connect to with no busy-wait.

Changed in v2:

  - Drop 'fdset' property / address kind, and use 'fd' for both CLI and HMP
  - Add unit tests

Daniel P. Berrange (2):
  io: move fd_is_socket() into common sockets code
  char: allow passing pre-opened socket file descriptor at startup

 chardev/char-socket.c  |  32 +++++++--
 chardev/char.c         |   3 +
 include/qemu/sockets.h |   1 +
 io/channel-util.c      |  13 ----
 tests/test-char.c      | 173 ++++++++++++++++++++++++++++++++++++++++++++++++-
 util/qemu-sockets.c    |  55 +++++++++++++++-
 6 files changed, 252 insertions(+), 25 deletions(-)

-- 
2.14.3

[Qemu-devel] [PATCH v2 1/2] io: move fd_is_socket() into common sockets code

[Daniel P. Berrange]

The fd_is_socket() helper method is useful in a few places, so put it in
the common sockets code.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 include/qemu/sockets.h |  1 +
 io/channel-util.c      | 13 -------------
 util/qemu-sockets.c    | 13 +++++++++++++
 3 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index 4f7311b52a..5680880f5a 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -12,6 +12,7 @@ int inet_aton(const char *cp, struct in_addr *ia);
 #include "qapi-types.h"
 
 /* misc helpers */
+bool fd_is_socket(int fd);
 int qemu_socket(int domain, int type, int protocol);
 int qemu_accept(int s, struct sockaddr *addr, socklen_t *addrlen);
 int socket_set_cork(int fd, int v);
diff --git a/io/channel-util.c b/io/channel-util.c
index 0fb4bd0837..423d79845a 100644
--- a/io/channel-util.c
+++ b/io/channel-util.c
@@ -24,19 +24,6 @@
 #include "io/channel-socket.h"
 
 
-static bool fd_is_socket(int fd)
-{
-    int optval;
-    socklen_t optlen;
-    optlen = sizeof(optval);
-    return qemu_getsockopt(fd,
-                           SOL_SOCKET,
-                           SO_TYPE,
-                           (char *)&optval,
-                           &optlen) == 0;
-}
-
-
 QIOChannel *qio_channel_new_fd(int fd,
                                Error **errp)
 {
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index af4f01211a..1d23f0b742 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -91,6 +91,19 @@ NetworkAddressFamily inet_netfamily(int family)
     return NETWORK_ADDRESS_FAMILY_UNKNOWN;
 }
 
+bool fd_is_socket(int fd)
+{
+    int optval;
+    socklen_t optlen;
+    optlen = sizeof(optval);
+    return qemu_getsockopt(fd,
+                           SOL_SOCKET,
+                           SO_TYPE,
+                           (char *)&optval,
+                           &optlen) == 0;
+}
+
+
 /*
  * Matrix we're trying to apply
  *
-- 
2.14.3

Re: [Qemu-devel] [PATCH v2 1/2] io: move fd_is_socket() into common sockets code

[Eric Blake]

On 12/21/2017 09:59 AM, Daniel P. Berrange wrote:
> The fd_is_socket() helper method is useful in a few places, so put it in
> the common sockets code.
> 
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>   include/qemu/sockets.h |  1 +
>   io/channel-util.c      | 13 -------------
>   util/qemu-sockets.c    | 13 +++++++++++++
>   3 files changed, 14 insertions(+), 13 deletions(-)

Reviewed-by: Eric Blake <eblake@redhat.com>

But while you are touching this...

> +++ b/util/qemu-sockets.c
> @@ -91,6 +91,19 @@ NetworkAddressFamily inet_netfamily(int family)
>       return NETWORK_ADDRESS_FAMILY_UNKNOWN;
>   }
>   
> +bool fd_is_socket(int fd)
> +{
> +    int optval;
> +    socklen_t optlen;
> +    optlen = sizeof(optval);
> +    return qemu_getsockopt(fd,
> +                           SOL_SOCKET,
> +                           SO_TYPE,
> +                           (char *)&optval,

This cast is pointless (although you are just moving it from the old 
code).  qemu_getsockopt() already takes care of casting for mingw (where 
the signature is not POSIX-compliant), and on all other platforms, the 
argument is already prototyped as void*; and since void* accepts 
anything, you don't have to go through an intermediate char*.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH v2 1/2] io: move fd_is_socket() into common sockets code

[Markus Armbruster]

Eric Blake <eblake@redhat.com> writes:

> On 12/21/2017 09:59 AM, Daniel P. Berrange wrote:
>> The fd_is_socket() helper method is useful in a few places, so put it in
>> the common sockets code.
>>
>> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
>> ---
>>   include/qemu/sockets.h |  1 +
>>   io/channel-util.c      | 13 -------------
>>   util/qemu-sockets.c    | 13 +++++++++++++
>>   3 files changed, 14 insertions(+), 13 deletions(-)
>
> Reviewed-by: Eric Blake <eblake@redhat.com>
>
> But while you are touching this...
>
>> +++ b/util/qemu-sockets.c
>> @@ -91,6 +91,19 @@ NetworkAddressFamily inet_netfamily(int family)
>>       return NETWORK_ADDRESS_FAMILY_UNKNOWN;
>>   }
>>   +bool fd_is_socket(int fd)
>> +{
>> +    int optval;
>> +    socklen_t optlen;
>> +    optlen = sizeof(optval);
>> +    return qemu_getsockopt(fd,
>> +                           SOL_SOCKET,
>> +                           SO_TYPE,
>> +                           (char *)&optval,
>
> This cast is pointless (although you are just moving it from the old
> code).  qemu_getsockopt() already takes care of casting for mingw
> (where the signature is not POSIX-compliant), and on all other
> platforms, the argument is already prototyped as void*; and since
> void* accepts anything, you don't have to go through an intermediate
> char*.

If we're tweaking, then I'd like it tweaked so:

    bool fd_is_socket(int fd)
    {
        int optval;
        socklen_t optlen = sizeof(optval);

        return !qemu_getsockopt(fd, SOL_SOCKET, SO_TYPE, &optval, &optlen);
    }

With or without such tweaks:
Reviewed-by: Markus Armbruster <armbru@redhat.com>

Re: [Qemu-devel] [PATCH v2 1/2] io: move fd_is_socket() into common sockets code

[Daniel P. Berrange]

On Fri, Dec 22, 2017 at 09:55:29AM +0100, Markus Armbruster wrote:
> Eric Blake <eblake@redhat.com> writes:
> 
> > On 12/21/2017 09:59 AM, Daniel P. Berrange wrote:
> >> The fd_is_socket() helper method is useful in a few places, so put it in
> >> the common sockets code.
> >>
> >> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> >> ---
> >>   include/qemu/sockets.h |  1 +
> >>   io/channel-util.c      | 13 -------------
> >>   util/qemu-sockets.c    | 13 +++++++++++++
> >>   3 files changed, 14 insertions(+), 13 deletions(-)
> >
> > Reviewed-by: Eric Blake <eblake@redhat.com>
> >
> > But while you are touching this...
> >
> >> +++ b/util/qemu-sockets.c
> >> @@ -91,6 +91,19 @@ NetworkAddressFamily inet_netfamily(int family)
> >>       return NETWORK_ADDRESS_FAMILY_UNKNOWN;
> >>   }
> >>   +bool fd_is_socket(int fd)
> >> +{
> >> +    int optval;
> >> +    socklen_t optlen;
> >> +    optlen = sizeof(optval);
> >> +    return qemu_getsockopt(fd,
> >> +                           SOL_SOCKET,
> >> +                           SO_TYPE,
> >> +                           (char *)&optval,
> >
> > This cast is pointless (although you are just moving it from the old
> > code).  qemu_getsockopt() already takes care of casting for mingw
> > (where the signature is not POSIX-compliant), and on all other
> > platforms, the argument is already prototyped as void*; and since
> > void* accepts anything, you don't have to go through an intermediate
> > char*.
> 
> If we're tweaking, then I'd like it tweaked so:
> 
>     bool fd_is_socket(int fd)
>     {
>         int optval;
>         socklen_t optlen = sizeof(optval);
> 
>         return !qemu_getsockopt(fd, SOL_SOCKET, SO_TYPE, &optval, &optlen);
>     }

Yes I'll do exactly that.

> 
> With or without such tweaks:
> Reviewed-by: Markus Armbruster <armbru@redhat.com>

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

[Qemu-devel] [PATCH v2 2/2] char: allow passing pre-opened socket file descriptor at startup

[Daniel P. Berrange]

When starting QEMU management apps will usually setup a monitor socket, and
then open it immediately after startup. If not using QEMU's own -daemonize
arg, this process can be troublesome to handle correctly. The mgmt app will
need to repeatedly call connect() until it succeeds, because it does not
know when QEMU has created the listener socket. If can't retry connect()
forever though, because an error might have caused QEMU to exit before it
even creates the monitor.

The obvious way to fix this kind of problem is to just pass in a pre-opened
socket file descriptor for the QEMU monitor to listen on. The management app
can now immediately call connect() just once. If connect() fails it knows
that QEMU has exited with an error.

The SocketAddress(Legacy) structs allow for FD passing via the monitor, using
the 'getfd' command, but only when using QMP JSON syntax. The HMP & CLI syntax
for chardevs, however, has no way to initialize the SocketAddress(Legacy) 'fd'
variant. So this patch wires up the 'fd' parameter to refer to a refer to a
passed in file descriptor. It can refer either to a named FD passed via the
'getfd' command, as already supported with QMP, or if numeric it refers to an
FD passed to QEMU at startup. This allows both HMP usage:

   (pass any FD number with SCM_RIGHTS)
   getfd myfd
   chardev-add socket,fd=myfd

And also CLI usage

  (leak FD 3 from parent by clearing O_CLOEXEC)
  -chardev socket,fd=3,id=mon
  -mon chardev=mon,mode=control

Note that we do not wire this up in the legacy chardev syntax, so you cannot
use FD passing with '-qmp', you must use the modern '-mon' + '-chardev' pair

An illustrative example of usage is:

  #!/usr/bin/perl

  use IO::Socket::UNIX;
  use Fcntl;

  unlink "/tmp/qmp";
  my $srv = IO::Socket::UNIX->new(
    Type => SOCK_STREAM(),
    Local => "/tmp/qmp",
    Listen => 1,
  );

  my $flags = fcntl $srv, F_GETFD, 0;
  fcntl $srv, F_SETFD, $flags & ~FD_CLOEXEC;

  my $fd = $srv->fileno();

  exec "qemu-system-x86_64", \
      "-chardev", "socket,fd=$fd,server,nowait,id=mon", \
      "-mon", "chardev=mon,mode=control";

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 chardev/char-socket.c |  32 ++++++++--
 chardev/char.c        |   3 +
 tests/test-char.c     | 173 +++++++++++++++++++++++++++++++++++++++++++++++++-
 util/qemu-sockets.c   |  42 +++++++++++-
 4 files changed, 238 insertions(+), 12 deletions(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 6013972f72..e162db7542 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -28,6 +28,7 @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qapi/clone-visitor.h"
+#include "qemu/cutils.h"
 
 #include "chardev/char-io.h"
 
@@ -983,25 +984,36 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
     const char *path = qemu_opt_get(opts, "path");
     const char *host = qemu_opt_get(opts, "host");
     const char *port = qemu_opt_get(opts, "port");
+    const char *fd = qemu_opt_get(opts, "fd");
     const char *tls_creds = qemu_opt_get(opts, "tls-creds");
     SocketAddressLegacy *addr;
     ChardevSocket *sock;
 
+    if ((!!path + !!fd + !!host) != 1) {
+        error_setg(errp,
+                   "Exactly one of 'path', 'fd' or 'host' required");
+        return;
+    }
+
     backend->type = CHARDEV_BACKEND_KIND_SOCKET;
-    if (!path) {
-        if (!host) {
-            error_setg(errp, "chardev: socket: no host given");
+    if (path) {
+        if (tls_creds) {
+            error_setg(errp, "TLS can only be used over TCP socket");
             return;
         }
+    } else if (host) {
         if (!port) {
             error_setg(errp, "chardev: socket: no port given");
             return;
         }
-    } else {
-        if (tls_creds) {
-            error_setg(errp, "TLS can only be used over TCP socket");
+    } else if (fd) {
+        /* We don't know what host to validate against when in client mode */
+        if (tls_creds && !is_listen) {
+            error_setg(errp, "TLS can not be used with pre-opened client FD");
             return;
         }
+    } else {
+        g_assert_not_reached();
     }
 
     sock = backend->u.socket.data = g_new0(ChardevSocket, 1);
@@ -1027,7 +1039,7 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
         addr->type = SOCKET_ADDRESS_LEGACY_KIND_UNIX;
         q_unix = addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
         q_unix->path = g_strdup(path);
-    } else {
+    } else if (host) {
         addr->type = SOCKET_ADDRESS_LEGACY_KIND_INET;
         addr->u.inet.data = g_new(InetSocketAddress, 1);
         *addr->u.inet.data = (InetSocketAddress) {
@@ -1040,6 +1052,12 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
             .has_ipv6 = qemu_opt_get(opts, "ipv6"),
             .ipv6 = qemu_opt_get_bool(opts, "ipv6", 0),
         };
+    } else if (fd) {
+        addr->type = SOCKET_ADDRESS_LEGACY_KIND_FD;
+        addr->u.fd.data = g_new(String, 1);
+        addr->u.fd.data->str = g_strdup(fd);
+    } else {
+        g_assert_not_reached();
     }
     sock->addr = addr;
 }
diff --git a/chardev/char.c b/chardev/char.c
index 2ae4f465ec..9d674855ae 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -798,6 +798,9 @@ QemuOptsList qemu_chardev_opts = {
         },{
             .name = "port",
             .type = QEMU_OPT_STRING,
+        },{
+            .name = "fd",
+            .type = QEMU_OPT_STRING,
         },{
             .name = "localaddr",
             .type = QEMU_OPT_STRING,
diff --git a/tests/test-char.c b/tests/test-char.c
index 7ac25ff73f..e72a20f0c2 100644
--- a/tests/test-char.c
+++ b/tests/test-char.c
@@ -9,6 +9,7 @@
 #include "qapi/error.h"
 #include "qom/qom-qobject.h"
 #include "qmp-commands.h"
+#include "monitor/monitor.h"
 
 static bool quit;
 
@@ -284,9 +285,8 @@ static int socket_can_read_hello(void *opaque)
     return 10;
 }
 
-static void char_socket_test(void)
+static void char_socket_test_common(Chardev *chr)
 {
-    Chardev *chr = qemu_chr_new("server", "tcp:127.0.0.1:0,server,nowait");
     Chardev *chr_client;
     QObject *addr;
     QDict *qdict;
@@ -341,6 +341,169 @@ static void char_socket_test(void)
     object_unparent(OBJECT(chr));
 }
 
+
+static void char_socket_basic_test(void)
+{
+    Chardev *chr = qemu_chr_new("server", "tcp:127.0.0.1:0,server,nowait");
+
+    char_socket_test_common(chr);
+}
+
+
+static int char_socket_listener(void)
+{
+    SocketAddress *addr = g_new0(SocketAddress, 1);
+    int srv;
+
+    addr->type = SOCKET_ADDRESS_TYPE_INET;
+    addr->u.inet.host = g_strdup("127.0.0.1");
+    addr->u.inet.port = g_strdup("0");
+
+    srv = socket_listen(addr, &error_abort);
+    g_assert(srv >= 0);
+
+    qapi_free_SocketAddress(addr);
+    return srv;
+}
+
+
+/* If a monitor is not active (ie cur_mon == NULL), then
+ * we should be able to use fd=<NUMBER> syntax
+ */
+static void char_socket_fdpass_cli_test(void)
+{
+    Chardev *chr;
+    char *optstr;
+    QemuOpts *opts;
+    int fd;
+
+    g_assert_null(cur_mon);
+
+    fd = char_socket_listener();
+
+    optstr = g_strdup_printf("socket,id=cdev,fd=%d,server,nowait", fd);
+
+    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
+                                   optstr, true);
+    g_assert_nonnull(opts);
+
+    chr = qemu_chr_new_from_opts(opts, &error_abort);
+
+    qemu_opts_del(opts);
+
+    char_socket_test_common(chr);
+}
+
+
+static int mon_fd = -1;
+
+int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
+{
+    if (mon_fd == -1) {
+        error_setg(errp, "No fd named %s", fdname);
+        return -1;
+    }
+    return mon_fd;
+}
+
+/* Syms in libqemustub.a are discarded at .o file granularity.
+ * To replace monitor_get_fd() we must ensure everything in
+ * stubs/monitor.c is defined, to make sure monitor.o is discarded
+ * otherwise we get duplicate syms at link time.
+ */
+Monitor *cur_mon = NULL;
+void monitor_init(Chardev *chr, int flags) {}
+
+/* If a monitor is active (ie cur_mon != NULL), then
+ * we should be able to use fd=<NAME> syntax
+ */
+static void char_socket_fdpass_mon_test(void)
+{
+    Chardev *chr;
+    const char *optstr;
+    QemuOpts *opts;
+    int fd;
+
+    fd = char_socket_listener();
+    mon_fd = fd;
+    cur_mon = g_malloc(1); /* Pretend we have a mon available */
+
+    optstr = "socket,id=cdev,fd=myfd,server,nowait";
+
+    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
+                                   optstr, true);
+    g_assert_nonnull(opts);
+
+    chr = qemu_chr_new_from_opts(opts, &error_abort);
+
+    qemu_opts_del(opts);
+
+    char_socket_test_common(chr);
+    mon_fd = -1;
+    g_free(cur_mon);
+    cur_mon = NULL;
+}
+
+
+/* If a monitor is active (ie cur_mon != NULL), then
+ * we should not allow using fd=<NUMBER> syntax
+ */
+static void char_socket_fdpass_nocli_test(void)
+{
+    Chardev *chr;
+    char *optstr;
+    QemuOpts *opts;
+    int fd;
+    Error *local_err = NULL;
+
+    fd = char_socket_listener();
+    cur_mon = g_malloc(1); /* Pretend we have a mon available */
+
+    optstr = g_strdup_printf("socket,id=cdev,fd=%d,server,nowait", fd);
+
+    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
+                                   optstr, true);
+    g_assert_nonnull(opts);
+
+    chr = qemu_chr_new_from_opts(opts, &local_err);
+
+    qemu_opts_del(opts);
+
+    g_assert_nonnull(local_err);
+    g_assert_null(chr);
+    error_free(local_err);
+    g_free(cur_mon);
+    cur_mon = NULL;
+}
+
+
+/* If a monitor is not active (ie cur_mon == NULL), then
+ * we should not allow using fd=<NAME> syntax
+ */
+static void char_socket_fdpass_nomon_test(void)
+{
+    Chardev *chr;
+    const char *optstr;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+
+    g_assert_null(cur_mon);
+    optstr = "socket,id=cdev,fd=myfd,server,nowait";
+
+    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
+                                   optstr, true);
+    g_assert_nonnull(opts);
+
+    chr = qemu_chr_new_from_opts(opts, &local_err);
+
+    qemu_opts_del(opts);
+
+    g_assert_nonnull(local_err);
+    g_assert_null(chr);
+    error_free(local_err);
+}
+
+
 #ifndef _WIN32
 static void char_pipe_test(void)
 {
@@ -757,7 +920,11 @@ int main(int argc, char **argv)
 #ifndef _WIN32
     g_test_add_func("/char/file-fifo", char_file_fifo_test);
 #endif
-    g_test_add_func("/char/socket", char_socket_test);
+    g_test_add_func("/char/socket/basic", char_socket_basic_test);
+    g_test_add_func("/char/socket/fdpass/cli", char_socket_fdpass_cli_test);
+    g_test_add_func("/char/socket/fdpass/mon", char_socket_fdpass_mon_test);
+    g_test_add_func("/char/socket/fdpass/nocli", char_socket_fdpass_nocli_test);
+    g_test_add_func("/char/socket/fdpass/nomon", char_socket_fdpass_nomon_test);
     g_test_add_func("/char/udp", char_udp_test);
 #ifdef HAVE_CHARDEV_SERIAL
     g_test_add_func("/char/serial", char_serial_test);
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 1d23f0b742..9400f9a940 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -1046,7 +1046,26 @@ int socket_connect(SocketAddress *addr, Error **errp)
         break;
 
     case SOCKET_ADDRESS_TYPE_FD:
-        fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
+        if (cur_mon) {
+            fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
+            if (fd < 0) {
+                return -1;
+            }
+        } else {
+            unsigned long i;
+            if (qemu_strtoul(addr->u.fd.str, NULL, 10, &i) < 0) {
+                error_setg_errno(errp, errno,
+                                 "Unable to parse FD number %s",
+                                 addr->u.fd.str);
+                return -1;
+            }
+            fd = i;
+        }
+        if (!fd_is_socket(fd)) {
+            error_setg(errp, "Expected a socket FD %s", addr->u.fd.str);
+            close(fd);
+            return -1;
+        }
         break;
 
     case SOCKET_ADDRESS_TYPE_VSOCK:
@@ -1073,7 +1092,26 @@ int socket_listen(SocketAddress *addr, Error **errp)
         break;
 
     case SOCKET_ADDRESS_TYPE_FD:
-        fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
+        if (cur_mon) {
+            fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
+            if (fd < 0) {
+                return -1;
+            }
+        } else {
+            unsigned long i;
+            if (qemu_strtoul(addr->u.fd.str, NULL, 10, &i) < 0) {
+                error_setg_errno(errp, errno,
+                                 "Unable to parse FD number %s",
+                                 addr->u.fd.str);
+                return -1;
+            }
+            fd = i;
+        }
+        if (!fd_is_socket(fd)) {
+            error_setg(errp, "Expected a socket FD %s", addr->u.fd.str);
+            close(fd);
+            return -1;
+        }
         break;
 
     case SOCKET_ADDRESS_TYPE_VSOCK:
-- 
2.14.3

Re: [Qemu-devel] [PATCH v2 2/2] char: allow passing pre-opened socket file descriptor at startup

[Eric Blake]

On 12/21/2017 09:59 AM, Daniel P. Berrange wrote:
> When starting QEMU management apps will usually setup a monitor socket, and
> then open it immediately after startup. If not using QEMU's own -daemonize
> arg, this process can be troublesome to handle correctly. The mgmt app will
> need to repeatedly call connect() until it succeeds, because it does not
> know when QEMU has created the listener socket. If can't retry connect()
> forever though, because an error might have caused QEMU to exit before it
> even creates the monitor.
> 
> The obvious way to fix this kind of problem is to just pass in a pre-opened
> socket file descriptor for the QEMU monitor to listen on. The management app
> can now immediately call connect() just once. If connect() fails it knows
> that QEMU has exited with an error.
> 

> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
> ---
>   chardev/char-socket.c |  32 ++++++++--
>   chardev/char.c        |   3 +
>   tests/test-char.c     | 173 +++++++++++++++++++++++++++++++++++++++++++++++++-
>   util/qemu-sockets.c   |  42 +++++++++++-
>   4 files changed, 238 insertions(+), 12 deletions(-)
> 

> @@ -983,25 +984,36 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
>       const char *path = qemu_opt_get(opts, "path");
>       const char *host = qemu_opt_get(opts, "host");
>       const char *port = qemu_opt_get(opts, "port");
> +    const char *fd = qemu_opt_get(opts, "fd");
>       const char *tls_creds = qemu_opt_get(opts, "tls-creds");
>       SocketAddressLegacy *addr;
>       ChardevSocket *sock;
>   
> +    if ((!!path + !!fd + !!host) != 1) {

I see you liked my suggestion for a compact rendering; the resulting 
line has more symbols than it does alphanumerics ;)


> +/* Syms in libqemustub.a are discarded at .o file granularity.
> + * To replace monitor_get_fd() we must ensure everything in
> + * stubs/monitor.c is defined, to make sure monitor.o is discarded
> + * otherwise we get duplicate syms at link time.
> + */
> +Monitor *cur_mon = NULL;

Patchew is correct that you can omit the ' = NULL'.

With that tweaked,
Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH v2 2/2] char: allow passing pre-opened socket file descriptor at startup

[Markus Armbruster]

"Daniel P. Berrange" <berrange@redhat.com> writes:

> When starting QEMU management apps will usually setup a monitor socket, and
> then open it immediately after startup. If not using QEMU's own -daemonize
> arg, this process can be troublesome to handle correctly. The mgmt app will
> need to repeatedly call connect() until it succeeds, because it does not
> know when QEMU has created the listener socket. If can't retry connect()
> forever though, because an error might have caused QEMU to exit before it
> even creates the monitor.
>
> The obvious way to fix this kind of problem is to just pass in a pre-opened
> socket file descriptor for the QEMU monitor to listen on. The management app
> can now immediately call connect() just once. If connect() fails it knows
> that QEMU has exited with an error.
>
> The SocketAddress(Legacy) structs allow for FD passing via the monitor, using
> the 'getfd' command, but only when using QMP JSON syntax. The HMP & CLI syntax
> for chardevs, however, has no way to initialize the SocketAddress(Legacy) 'fd'
> variant. So this patch wires up the 'fd' parameter to refer to a refer to a
> passed in file descriptor. It can refer either to a named FD passed via the
> 'getfd' command, as already supported with QMP, or if numeric it refers to an
> FD passed to QEMU at startup. This allows both HMP usage:

Missing piece of the argument: getfd rejects names starting with a
digit.  Without that, we'd be looking at incompatible change.

>
>    (pass any FD number with SCM_RIGHTS)
>    getfd myfd
>    chardev-add socket,fd=myfd
>
> And also CLI usage
>
>   (leak FD 3 from parent by clearing O_CLOEXEC)

Took me a few seconds to get this is prescription, not description.
Drop the parenthesis?  Or make it clearer, say (parent process must set
up and pass FD 3 to QEMU)?

>   -chardev socket,fd=3,id=mon
>   -mon chardev=mon,mode=control

Not 100% clear whether a monitor command can use numeric syntax.
Peeking ahead at qemu-sockets.c: it can't.  Please spell it out.

>
> Note that we do not wire this up in the legacy chardev syntax, so you cannot
> use FD passing with '-qmp', you must use the modern '-mon' + '-chardev' pair
>
> An illustrative example of usage is:
>
>   #!/usr/bin/perl
>
>   use IO::Socket::UNIX;
>   use Fcntl;
>
>   unlink "/tmp/qmp";
>   my $srv = IO::Socket::UNIX->new(
>     Type => SOCK_STREAM(),
>     Local => "/tmp/qmp",
>     Listen => 1,
>   );
>
>   my $flags = fcntl $srv, F_GETFD, 0;
>   fcntl $srv, F_SETFD, $flags & ~FD_CLOEXEC;
>
>   my $fd = $srv->fileno();
>
>   exec "qemu-system-x86_64", \
>       "-chardev", "socket,fd=$fd,server,nowait,id=mon", \
>       "-mon", "chardev=mon,mode=control";
>
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Despite the issues I noted: this is a nice commit message, in particular
the example.

However, please wrap your lines between column 70 and 75.  Two reasons:
1. it should fit within 80 columns even with the four spaces git-log
adds, and more importantly 2. humans tend to have trouble following long
lines with our eyes (I sure do).  Typographic manuals suggest to limit
columns to roughly 60 characters for exactly that reason[*].

> ---
>  chardev/char-socket.c |  32 ++++++++--
>  chardev/char.c        |   3 +
>  tests/test-char.c     | 173 +++++++++++++++++++++++++++++++++++++++++++++++++-
>  util/qemu-sockets.c   |  42 +++++++++++-
>  4 files changed, 238 insertions(+), 12 deletions(-)
>
> diff --git a/chardev/char-socket.c b/chardev/char-socket.c
> index 6013972f72..e162db7542 100644
> --- a/chardev/char-socket.c
> +++ b/chardev/char-socket.c
> @@ -28,6 +28,7 @@
>  #include "qemu/error-report.h"
>  #include "qapi/error.h"
>  #include "qapi/clone-visitor.h"
> +#include "qemu/cutils.h"
>  
>  #include "chardev/char-io.h"
>  
> @@ -983,25 +984,36 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
>      const char *path = qemu_opt_get(opts, "path");
>      const char *host = qemu_opt_get(opts, "host");
>      const char *port = qemu_opt_get(opts, "port");
> +    const char *fd = qemu_opt_get(opts, "fd");
>      const char *tls_creds = qemu_opt_get(opts, "tls-creds");
>      SocketAddressLegacy *addr;
>      ChardevSocket *sock;
>  
> +    if ((!!path + !!fd + !!host) != 1) {
> +        error_setg(errp,
> +                   "Exactly one of 'path', 'fd' or 'host' required");
> +        return;
> +    }
> +
>      backend->type = CHARDEV_BACKEND_KIND_SOCKET;
> -    if (!path) {
> -        if (!host) {
> -            error_setg(errp, "chardev: socket: no host given");
> +    if (path) {
> +        if (tls_creds) {
> +            error_setg(errp, "TLS can only be used over TCP socket");
>              return;
>          }
> +    } else if (host) {
>          if (!port) {
>              error_setg(errp, "chardev: socket: no port given");
>              return;
>          }
> -    } else {
> -        if (tls_creds) {
> -            error_setg(errp, "TLS can only be used over TCP socket");
> +    } else if (fd) {
> +        /* We don't know what host to validate against when in client mode */
> +        if (tls_creds && !is_listen) {
> +            error_setg(errp, "TLS can not be used with pre-opened client FD");
>              return;

Worth mentioning this restriction in the commit message?

>          }
> +    } else {
> +        g_assert_not_reached();
>      }
>  
>      sock = backend->u.socket.data = g_new0(ChardevSocket, 1);

This is cleanup and feature squashed together.  Separate the two please.

> @@ -1027,7 +1039,7 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
>          addr->type = SOCKET_ADDRESS_LEGACY_KIND_UNIX;
>          q_unix = addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
>          q_unix->path = g_strdup(path);
> -    } else {
> +    } else if (host) {
>          addr->type = SOCKET_ADDRESS_LEGACY_KIND_INET;
>          addr->u.inet.data = g_new(InetSocketAddress, 1);
>          *addr->u.inet.data = (InetSocketAddress) {
> @@ -1040,6 +1052,12 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
>              .has_ipv6 = qemu_opt_get(opts, "ipv6"),
>              .ipv6 = qemu_opt_get_bool(opts, "ipv6", 0),
>          };
> +    } else if (fd) {
> +        addr->type = SOCKET_ADDRESS_LEGACY_KIND_FD;
> +        addr->u.fd.data = g_new(String, 1);
> +        addr->u.fd.data->str = g_strdup(fd);
> +    } else {
> +        g_assert_not_reached();
>      }
>      sock->addr = addr;
>  }
> diff --git a/chardev/char.c b/chardev/char.c
> index 2ae4f465ec..9d674855ae 100644
> --- a/chardev/char.c
> +++ b/chardev/char.c
> @@ -798,6 +798,9 @@ QemuOptsList qemu_chardev_opts = {
>          },{
>              .name = "port",
>              .type = QEMU_OPT_STRING,
> +        },{
> +            .name = "fd",
> +            .type = QEMU_OPT_STRING,
>          },{
>              .name = "localaddr",
>              .type = QEMU_OPT_STRING,
> diff --git a/tests/test-char.c b/tests/test-char.c
> index 7ac25ff73f..e72a20f0c2 100644
> --- a/tests/test-char.c
> +++ b/tests/test-char.c
> @@ -9,6 +9,7 @@
>  #include "qapi/error.h"
>  #include "qom/qom-qobject.h"
>  #include "qmp-commands.h"
> +#include "monitor/monitor.h"
>  
>  static bool quit;
>  
> @@ -284,9 +285,8 @@ static int socket_can_read_hello(void *opaque)
>      return 10;
>  }
>  
> -static void char_socket_test(void)
> +static void char_socket_test_common(Chardev *chr)
>  {
> -    Chardev *chr = qemu_chr_new("server", "tcp:127.0.0.1:0,server,nowait");
>      Chardev *chr_client;
>      QObject *addr;
>      QDict *qdict;
> @@ -341,6 +341,169 @@ static void char_socket_test(void)
>      object_unparent(OBJECT(chr));
>  }
>  
> +
> +static void char_socket_basic_test(void)
> +{
> +    Chardev *chr = qemu_chr_new("server", "tcp:127.0.0.1:0,server,nowait");
> +
> +    char_socket_test_common(chr);
> +}
> +
> +
> +static int char_socket_listener(void)
> +{
> +    SocketAddress *addr = g_new0(SocketAddress, 1);
> +    int srv;
> +
> +    addr->type = SOCKET_ADDRESS_TYPE_INET;
> +    addr->u.inet.host = g_strdup("127.0.0.1");
> +    addr->u.inet.port = g_strdup("0");
> +
> +    srv = socket_listen(addr, &error_abort);
> +    g_assert(srv >= 0);
> +
> +    qapi_free_SocketAddress(addr);
> +    return srv;
> +}
> +
> +
> +/* If a monitor is not active (ie cur_mon == NULL), then
> + * we should be able to use fd=<NUMBER> syntax
> + */
> +static void char_socket_fdpass_cli_test(void)
> +{
> +    Chardev *chr;
> +    char *optstr;
> +    QemuOpts *opts;
> +    int fd;
> +
> +    g_assert_null(cur_mon);
> +
> +    fd = char_socket_listener();
> +
> +    optstr = g_strdup_printf("socket,id=cdev,fd=%d,server,nowait", fd);
> +

I was asking myself where the fdset with ID @fd is set up, and only then
discovered that your monitor_get_fd() ignores @fdname, so no further
setup is necessary.  Might be worth a comment somewhere.

> +    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
> +                                   optstr, true);
> +    g_assert_nonnull(opts);

Leaks @optstr?

> +
> +    chr = qemu_chr_new_from_opts(opts, &error_abort);
> +
> +    qemu_opts_del(opts);
> +
> +    char_socket_test_common(chr);
> +}
> +
> +
> +static int mon_fd = -1;
> +
> +int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
> +{
> +    if (mon_fd == -1) {
> +        error_setg(errp, "No fd named %s", fdname);
> +        return -1;
> +    }
> +    return mon_fd;
> +}

Maps all names to @mon_fd.  I guess that's good enough for this test.

> +
> +/* Syms in libqemustub.a are discarded at .o file granularity.
> + * To replace monitor_get_fd() we must ensure everything in
> + * stubs/monitor.c is defined, to make sure monitor.o is discarded
> + * otherwise we get duplicate syms at link time.
> + */
> +Monitor *cur_mon = NULL;
> +void monitor_init(Chardev *chr, int flags) {}
> +
> +/* If a monitor is active (ie cur_mon != NULL), then
> + * we should be able to use fd=<NAME> syntax
> + */
> +static void char_socket_fdpass_mon_test(void)
> +{
> +    Chardev *chr;
> +    const char *optstr;
> +    QemuOpts *opts;
> +    int fd;
> +
> +    fd = char_socket_listener();
> +    mon_fd = fd;
> +    cur_mon = g_malloc(1); /* Pretend we have a mon available */

Feels unnecessarily dirty.  Suggest to define cur_mon like this:

   static Monitor dummy_mon;
   Monitor *cur_mon = &dummy_mon;  /* Pretend we have a mon available */

Or in case cur_mon must remain null outside this function, set it like
this:

       Monitor dummy_mon = {0};
       cur_mon = &dummy_mon;       /* Pretend we have a mon available */

More of the same below.

> +
> +    optstr = "socket,id=cdev,fd=myfd,server,nowait";
> +

Similar to above, no further setup needed for @myfd.

> +    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
> +                                   optstr, true);
> +    g_assert_nonnull(opts);
> +
> +    chr = qemu_chr_new_from_opts(opts, &error_abort);
> +
> +    qemu_opts_del(opts);
> +
> +    char_socket_test_common(chr);
> +    mon_fd = -1;
> +    g_free(cur_mon);
> +    cur_mon = NULL;
> +}
> +
> +
> +/* If a monitor is active (ie cur_mon != NULL), then
> + * we should not allow using fd=<NUMBER> syntax
> + */
> +static void char_socket_fdpass_nocli_test(void)
> +{
> +    Chardev *chr;
> +    char *optstr;
> +    QemuOpts *opts;
> +    int fd;
> +    Error *local_err = NULL;
> +
> +    fd = char_socket_listener();
> +    cur_mon = g_malloc(1); /* Pretend we have a mon available */
> +
> +    optstr = g_strdup_printf("socket,id=cdev,fd=%d,server,nowait", fd);
> +
> +    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
> +                                   optstr, true);
> +    g_assert_nonnull(opts);

Leaks @optstr?

> +
> +    chr = qemu_chr_new_from_opts(opts, &local_err);
> +
> +    qemu_opts_del(opts);
> +
> +    g_assert_nonnull(local_err);

Please use error_free_or_abort() and ...

> +    g_assert_null(chr);
> +    error_free(local_err);

... drop the error_free().

> +    g_free(cur_mon);
> +    cur_mon = NULL;
> +}
> +
> +
> +/* If a monitor is not active (ie cur_mon == NULL), then
> + * we should not allow using fd=<NAME> syntax
> + */
> +static void char_socket_fdpass_nomon_test(void)
> +{
> +    Chardev *chr;
> +    const char *optstr;
> +    QemuOpts *opts;
> +    Error *local_err = NULL;
> +
> +    g_assert_null(cur_mon);
> +    optstr = "socket,id=cdev,fd=myfd,server,nowait";
> +
> +    opts = qemu_opts_parse_noisily(qemu_find_opts("chardev"),
> +                                   optstr, true);
> +    g_assert_nonnull(opts);
> +
> +    chr = qemu_chr_new_from_opts(opts, &local_err);
> +
> +    qemu_opts_del(opts);
> +
> +    g_assert_nonnull(local_err);
> +    g_assert_null(chr);
> +    error_free(local_err);

Likewise.

> +}
> +
> +
>  #ifndef _WIN32
>  static void char_pipe_test(void)
>  {
> @@ -757,7 +920,11 @@ int main(int argc, char **argv)
>  #ifndef _WIN32
>      g_test_add_func("/char/file-fifo", char_file_fifo_test);
>  #endif
> -    g_test_add_func("/char/socket", char_socket_test);
> +    g_test_add_func("/char/socket/basic", char_socket_basic_test);
> +    g_test_add_func("/char/socket/fdpass/cli", char_socket_fdpass_cli_test);
> +    g_test_add_func("/char/socket/fdpass/mon", char_socket_fdpass_mon_test);
> +    g_test_add_func("/char/socket/fdpass/nocli", char_socket_fdpass_nocli_test);
> +    g_test_add_func("/char/socket/fdpass/nomon", char_socket_fdpass_nomon_test);
>      g_test_add_func("/char/udp", char_udp_test);
>  #ifdef HAVE_CHARDEV_SERIAL
>      g_test_add_func("/char/serial", char_serial_test);
> diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
> index 1d23f0b742..9400f9a940 100644
> --- a/util/qemu-sockets.c
> +++ b/util/qemu-sockets.c
> @@ -1046,7 +1046,26 @@ int socket_connect(SocketAddress *addr, Error **errp)
>          break;
>  
>      case SOCKET_ADDRESS_TYPE_FD:
> -        fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
> +        if (cur_mon) {
> +            fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
> +            if (fd < 0) {
> +                return -1;
> +            }
> +        } else {
> +            unsigned long i;

Naming a long @i is bad taste.  Let's rename to @ul.

> +            if (qemu_strtoul(addr->u.fd.str, NULL, 10, &i) < 0) {
> +                error_setg_errno(errp, errno,
> +                                 "Unable to parse FD number %s",
> +                                 addr->u.fd.str);
> +                return -1;
> +            }
> +            fd = i;

Truncates silently.  Shouldn't you check for range?

If the parent process screws up passing the file descriptor, fd can
hijack some random internal file.  I'd ask you to catch that if I had
any idea how to do that easily.

In monitor context, you can only use named fds, as before.  Okay.

Outside monitor context, you can now use numeric fds, and only numeric
fds.  Makes sense, because named fds are associated with a monitor.
Note that before the patch, we crashed in monitor_get_fd() dereferencing
cur_mon.

> +        }
> +        if (!fd_is_socket(fd)) {
> +            error_setg(errp, "Expected a socket FD %s", addr->u.fd.str);

Would "File descriptor '%s' is not a socket" be clearer?

> +            close(fd);
> +            return -1;
> +        }
>          break;
>  
>      case SOCKET_ADDRESS_TYPE_VSOCK:
> @@ -1073,7 +1092,26 @@ int socket_listen(SocketAddress *addr, Error **errp)
>          break;
>  
>      case SOCKET_ADDRESS_TYPE_FD:
> -        fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
> +        if (cur_mon) {
> +            fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
> +            if (fd < 0) {
> +                return -1;
> +            }
> +        } else {
> +            unsigned long i;
> +            if (qemu_strtoul(addr->u.fd.str, NULL, 10, &i) < 0) {
> +                error_setg_errno(errp, errno,
> +                                 "Unable to parse FD number %s",
> +                                 addr->u.fd.str);
> +                return -1;
> +            }
> +            fd = i;
> +        }
> +        if (!fd_is_socket(fd)) {
> +            error_setg(errp, "Expected a socket FD %s", addr->u.fd.str);
> +            close(fd);
> +            return -1;
> +        }

Code duplication.  Please factor it out.

>          break;
>  
>      case SOCKET_ADDRESS_TYPE_VSOCK:

[*] https://en.wikipedia.org/wiki/Column_(typography)#Typographic_style

Re: [Qemu-devel] [PATCH v2 2/2] char: allow passing pre-opened socket file descriptor at startup

[Daniel P. Berrange]

On Fri, Dec 22, 2017 at 11:06:12AM +0100, Markus Armbruster wrote:
> "Daniel P. Berrange" <berrange@redhat.com> writes:

> > +
> > +/* Syms in libqemustub.a are discarded at .o file granularity.
> > + * To replace monitor_get_fd() we must ensure everything in
> > + * stubs/monitor.c is defined, to make sure monitor.o is discarded
> > + * otherwise we get duplicate syms at link time.
> > + */
> > +Monitor *cur_mon = NULL;
> > +void monitor_init(Chardev *chr, int flags) {}
> > +
> > +/* If a monitor is active (ie cur_mon != NULL), then
> > + * we should be able to use fd=<NAME> syntax
> > + */
> > +static void char_socket_fdpass_mon_test(void)
> > +{
> > +    Chardev *chr;
> > +    const char *optstr;
> > +    QemuOpts *opts;
> > +    int fd;
> > +
> > +    fd = char_socket_listener();
> > +    mon_fd = fd;
> > +    cur_mon = g_malloc(1); /* Pretend we have a mon available */
> 
> Feels unnecessarily dirty.  Suggest to define cur_mon like this:
> 
>    static Monitor dummy_mon;
>    Monitor *cur_mon = &dummy_mon;  /* Pretend we have a mon available */
> 
> Or in case cur_mon must remain null outside this function, set it like
> this:
> 
>        Monitor dummy_mon = {0};
>        cur_mon = &dummy_mon;       /* Pretend we have a mon available */
> 
> More of the same below.

FYI, I didn't do that because 'struct Monitor' is defined inside
monitor.c, not exposed in header files. I felt it would be worse
to pollute the header file with what's supposed to be a private
struct definition, just for sake of tests, particularly since
we don't actually need any of the Monitor object contents.

We could create a monitor-internal.h for the "struct Monitor"
definition, if you feel strongly we should take this approach
in the tests instead of my hack here ?


> > diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
> > index 1d23f0b742..9400f9a940 100644
> > --- a/util/qemu-sockets.c
> > +++ b/util/qemu-sockets.c
> > @@ -1046,7 +1046,26 @@ int socket_connect(SocketAddress *addr, Error **errp)
> >          break;
> >  
> >      case SOCKET_ADDRESS_TYPE_FD:
> > -        fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
> > +        if (cur_mon) {
> > +            fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
> > +            if (fd < 0) {
> > +                return -1;
> > +            }
> > +        } else {
> > +            unsigned long i;
> 
> Naming a long @i is bad taste.  Let's rename to @ul.
> 
> > +            if (qemu_strtoul(addr->u.fd.str, NULL, 10, &i) < 0) {
> > +                error_setg_errno(errp, errno,
> > +                                 "Unable to parse FD number %s",
> > +                                 addr->u.fd.str);
> > +                return -1;
> > +            }
> > +            fd = i;
> 
> Truncates silently.  Shouldn't you check for range?
> 
> If the parent process screws up passing the file descriptor, fd can
> hijack some random internal file.  I'd ask you to catch that if I had
> any idea how to do that easily.

I guess it is just a matter of defining yet another qemu_strtoNN variant
that takes an "int" parameter instead of "long", and does range checking.

> Outside monitor context, you can now use numeric fds, and only numeric
> fds.  Makes sense, because named fds are associated with a monitor.
> Note that before the patch, we crashed in monitor_get_fd() dereferencing
> cur_mon.

Yeah, that is fun, but I don't think there's any code path that could
trigger it.


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: [Qemu-devel] [PATCH v2 2/2] char: allow passing pre-opened socket file descriptor at startup

[Markus Armbruster]

"Daniel P. Berrange" <berrange@redhat.com> writes:

> On Fri, Dec 22, 2017 at 11:06:12AM +0100, Markus Armbruster wrote:
>> "Daniel P. Berrange" <berrange@redhat.com> writes:
>
>> > +
>> > +/* Syms in libqemustub.a are discarded at .o file granularity.
>> > + * To replace monitor_get_fd() we must ensure everything in
>> > + * stubs/monitor.c is defined, to make sure monitor.o is discarded
>> > + * otherwise we get duplicate syms at link time.
>> > + */
>> > +Monitor *cur_mon = NULL;
>> > +void monitor_init(Chardev *chr, int flags) {}
>> > +
>> > +/* If a monitor is active (ie cur_mon != NULL), then
>> > + * we should be able to use fd=<NAME> syntax
>> > + */
>> > +static void char_socket_fdpass_mon_test(void)
>> > +{
>> > +    Chardev *chr;
>> > +    const char *optstr;
>> > +    QemuOpts *opts;
>> > +    int fd;
>> > +
>> > +    fd = char_socket_listener();
>> > +    mon_fd = fd;
>> > +    cur_mon = g_malloc(1); /* Pretend we have a mon available */
>> 
>> Feels unnecessarily dirty.  Suggest to define cur_mon like this:
>> 
>>    static Monitor dummy_mon;
>>    Monitor *cur_mon = &dummy_mon;  /* Pretend we have a mon available */
>> 
>> Or in case cur_mon must remain null outside this function, set it like
>> this:
>> 
>>        Monitor dummy_mon = {0};
>>        cur_mon = &dummy_mon;       /* Pretend we have a mon available */
>> 
>> More of the same below.
>
> FYI, I didn't do that because 'struct Monitor' is defined inside
> monitor.c, not exposed in header files. I felt it would be worse

I see.

> to pollute the header file with what's supposed to be a private
> struct definition, just for sake of tests, particularly since
> we don't actually need any of the Monitor object contents.
>
> We could create a monitor-internal.h for the "struct Monitor"
> definition, if you feel strongly we should take this approach
> in the tests instead of my hack here ?

Might be more trouble than it's worth.  I can tolerate the hack in a
test.

>> > diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
>> > index 1d23f0b742..9400f9a940 100644
>> > --- a/util/qemu-sockets.c
>> > +++ b/util/qemu-sockets.c
>> > @@ -1046,7 +1046,26 @@ int socket_connect(SocketAddress *addr, Error **errp)
>> >          break;
>> >  
>> >      case SOCKET_ADDRESS_TYPE_FD:
>> > -        fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
>> > +        if (cur_mon) {
>> > +            fd = monitor_get_fd(cur_mon, addr->u.fd.str, errp);
>> > +            if (fd < 0) {
>> > +                return -1;
>> > +            }
>> > +        } else {
>> > +            unsigned long i;
>> 
>> Naming a long @i is bad taste.  Let's rename to @ul.
>> 
>> > +            if (qemu_strtoul(addr->u.fd.str, NULL, 10, &i) < 0) {
>> > +                error_setg_errno(errp, errno,
>> > +                                 "Unable to parse FD number %s",
>> > +                                 addr->u.fd.str);
>> > +                return -1;
>> > +            }
>> > +            fd = i;
>> 
>> Truncates silently.  Shouldn't you check for range?
>> 
>> If the parent process screws up passing the file descriptor, fd can
>> hijack some random internal file.  I'd ask you to catch that if I had
>> any idea how to do that easily.
>
> I guess it is just a matter of defining yet another qemu_strtoNN variant
> that takes an "int" parameter instead of "long", and does range checking.

Should do here.  Won't do for cases where the valid range doesn't match
an integer type.  I'm not asking you to address the general problem,
though.

>> Outside monitor context, you can now use numeric fds, and only numeric
>> fds.  Makes sense, because named fds are associated with a monitor.
>> Note that before the patch, we crashed in monitor_get_fd() dereferencing
>> cur_mon.
>
> Yeah, that is fun, but I don't think there's any code path that could
> trigger it.

One more thing: semantics of SocketAddress member @fd needs to be
documented in the QAPI schema.  I'd specify regardless of context,
i.e. decimal number is the file descriptor, anything else is a file
descriptor name.  Only then say which context accepts which.

Re: [Qemu-devel] [PATCH v2 0/2] Enable passing pre-opened chardev socket FDs

[no-reply]

Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 20171221155905.3793-1-berrange@redhat.com
Subject: [Qemu-devel] [PATCH v2 0/2] Enable passing pre-opened chardev socket FDs

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 * [new tag]               patchew/20171221160558.14151-1-laurent@vivier.eu -> patchew/20171221160558.14151-1-laurent@vivier.eu
Switched to a new branch 'test'
6116de2222 char: allow passing pre-opened socket file descriptor at startup
89d89b749c io: move fd_is_socket() into common sockets code

=== OUTPUT BEGIN ===
Checking PATCH 1/2: io: move fd_is_socket() into common sockets code...
Checking PATCH 2/2: char: allow passing pre-opened socket file descriptor at startup...
ERROR: do not initialise globals to 0 or NULL
#255: FILE: tests/test-char.c:414:
+Monitor *cur_mon = NULL;

total: 1 errors, 0 warnings, 330 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org