提交 e1f2641b 编写于 作者: L Luiz Capitulino

Monitor: Make output buffer dynamic

Commit f628926b changed monitor_flush()
to retry on qemu_chr_fe_write() errors. However, the Monitor's output
buffer can keep growing while the retry is not issued and this can
cause the buffer to overflow.

To reproduce this issue, just start qemu and type on the Monitor:

(qemu) ?

This will cause an assertion to trig.

To fix this problem this commit makes the Monitor buffer dynamic,
which means that it can grow as much as needed.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Acked-by: NGerd Hoffmann <kraxel@redhat.com>
上级 54d49ac9
...@@ -188,8 +188,7 @@ struct Monitor { ...@@ -188,8 +188,7 @@ struct Monitor {
int reset_seen; int reset_seen;
int flags; int flags;
int suspend_cnt; int suspend_cnt;
uint8_t outbuf[1024]; QString *outbuf;
int outbuf_index;
ReadLineState *rs; ReadLineState *rs;
MonitorControl *mc; MonitorControl *mc;
CPUArchState *mon_cpu; CPUArchState *mon_cpu;
...@@ -271,45 +270,52 @@ static gboolean monitor_unblocked(GIOChannel *chan, GIOCondition cond, ...@@ -271,45 +270,52 @@ static gboolean monitor_unblocked(GIOChannel *chan, GIOCondition cond,
void monitor_flush(Monitor *mon) void monitor_flush(Monitor *mon)
{ {
int rc; int rc;
size_t len;
const char *buf;
buf = qstring_get_str(mon->outbuf);
len = qstring_get_length(mon->outbuf);
if (mon && mon->outbuf_index != 0 && !mon->mux_out) { if (mon && len && !mon->mux_out) {
rc = qemu_chr_fe_write(mon->chr, mon->outbuf, mon->outbuf_index); rc = qemu_chr_fe_write(mon->chr, (const uint8_t *) buf, len);
if (rc == mon->outbuf_index) { if (rc == len) {
/* all flushed */ /* all flushed */
mon->outbuf_index = 0; QDECREF(mon->outbuf);
mon->outbuf = qstring_new();
return; return;
} }
if (rc > 0) { if (rc > 0) {
/* partinal write */ /* partinal write */
memmove(mon->outbuf, mon->outbuf + rc, mon->outbuf_index - rc); QString *tmp = qstring_from_str(buf + rc);
mon->outbuf_index -= rc; QDECREF(mon->outbuf);
mon->outbuf = tmp;
} }
qemu_chr_fe_add_watch(mon->chr, G_IO_OUT, monitor_unblocked, mon); qemu_chr_fe_add_watch(mon->chr, G_IO_OUT, monitor_unblocked, mon);
} }
} }
/* flush at every end of line or if the buffer is full */ /* flush at every end of line */
static void monitor_puts(Monitor *mon, const char *str) static void monitor_puts(Monitor *mon, const char *str)
{ {
char c; char c;
for(;;) { for(;;) {
assert(mon->outbuf_index < sizeof(mon->outbuf) - 1);
c = *str++; c = *str++;
if (c == '\0') if (c == '\0')
break; break;
if (c == '\n') if (c == '\n') {
mon->outbuf[mon->outbuf_index++] = '\r'; qstring_append_chr(mon->outbuf, '\r');
mon->outbuf[mon->outbuf_index++] = c; }
if (mon->outbuf_index >= (sizeof(mon->outbuf) - 1) qstring_append_chr(mon->outbuf, c);
|| c == '\n') if (c == '\n') {
monitor_flush(mon); monitor_flush(mon);
}
} }
} }
void monitor_vprintf(Monitor *mon, const char *fmt, va_list ap) void monitor_vprintf(Monitor *mon, const char *fmt, va_list ap)
{ {
char buf[4096]; char *buf;
if (!mon) if (!mon)
return; return;
...@@ -318,8 +324,9 @@ void monitor_vprintf(Monitor *mon, const char *fmt, va_list ap) ...@@ -318,8 +324,9 @@ void monitor_vprintf(Monitor *mon, const char *fmt, va_list ap)
return; return;
} }
vsnprintf(buf, sizeof(buf), fmt, ap); buf = g_strdup_vprintf(fmt, ap);
monitor_puts(mon, buf); monitor_puts(mon, buf);
g_free(buf);
} }
void monitor_printf(Monitor *mon, const char *fmt, ...) void monitor_printf(Monitor *mon, const char *fmt, ...)
...@@ -671,6 +678,8 @@ char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index, ...@@ -671,6 +678,8 @@ char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
CharDriverState mchar; CharDriverState mchar;
memset(&hmp, 0, sizeof(hmp)); memset(&hmp, 0, sizeof(hmp));
hmp.outbuf = qstring_new();
qemu_chr_init_mem(&mchar); qemu_chr_init_mem(&mchar);
hmp.chr = &mchar; hmp.chr = &mchar;
...@@ -699,6 +708,7 @@ char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index, ...@@ -699,6 +708,7 @@ char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
} }
out: out:
QDECREF(hmp.outbuf);
qemu_chr_close_mem(hmp.chr); qemu_chr_close_mem(hmp.chr);
return output; return output;
} }
...@@ -4749,6 +4759,7 @@ void monitor_init(CharDriverState *chr, int flags) ...@@ -4749,6 +4759,7 @@ void monitor_init(CharDriverState *chr, int flags)
} }
mon = g_malloc0(sizeof(*mon)); mon = g_malloc0(sizeof(*mon));
mon->outbuf = qstring_new();
mon->chr = chr; mon->chr = chr;
mon->flags = flags; mon->flags = flags;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册