rbd: switch from pipe to QEMUBH completion notification

rbd callbacks are called from non-QEMU threads.  Up until now a pipe was
used to signal completion back to the QEMU iothread.

The pipe writer code handles EAGAIN using select(2).  The select(2) API
is not scalable since fd_set size is static.  FD_SET() can write beyond
the end of fd_set if the file descriptor number is too high.  (QEMU's
main loop uses poll(2) to avoid this issue with select(2).)

Since the pipe itself is quite clumsy to use and QEMUBH is now
thread-safe, just schedule a BH from the rbd callback function.  This
way we can simplify I/O completion in addition to eliminating the
potential FD_SET() crash when file descriptor numbers become too high.

Crash scenario: QEMU already has 1024 file descriptors open.  Hotplug an
rbd drive and get the pipe writer to take the select(2) code path.

Reviewed-by: Josh Durgin <josh.durgin@inktank.com>
Tested-by: Josh Durgin <josh.durgin@inktank.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
1 file changed
tree: e1b2da9e26610cbd77f4e846c9846797bebcf020
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. default-configs/
  6. disas/
  7. docs/
  8. fpu/
  9. fsdev/
  10. gdb-xml/
  11. hw/
  12. include/
  13. libcacard/
  14. linux-headers/
  15. linux-user/
  16. net/
  17. pc-bios/
  18. po/
  19. qapi/
  20. qga/
  21. qobject/
  22. qom/
  23. roms/
  24. scripts/
  25. slirp/
  26. stubs/
  27. sysconfigs/
  28. target-alpha/
  29. target-arm/
  30. target-cris/
  31. target-i386/
  32. target-lm32/
  33. target-m68k/
  34. target-microblaze/
  35. target-mips/
  36. target-moxie/
  37. target-openrisc/
  38. target-ppc/
  39. target-s390x/
  40. target-sh4/
  41. target-sparc/
  42. target-unicore32/
  43. target-xtensa/
  44. tcg/
  45. tests/
  46. trace/
  47. ui/
  48. util/
  49. .exrc
  50. .gitignore
  51. .gitmodules
  52. .mailmap
  53. .travis.yml
  54. aio-posix.c
  55. aio-win32.c
  56. arch_init.c
  57. async.c
  58. balloon.c
  59. block-migration.c
  60. block.c
  61. blockdev-nbd.c
  62. blockdev.c
  63. blockjob.c
  64. bt-host.c
  65. bt-vhci.c
  66. Changelog
  67. CODING_STYLE
  68. configure
  69. COPYING
  70. COPYING.LIB
  71. coroutine-gthread.c
  72. coroutine-sigaltstack.c
  73. coroutine-ucontext.c
  74. coroutine-win32.c
  75. cpu-exec.c
  76. cpus.c
  77. cputlb.c
  78. device-hotplug.c
  79. device_tree.c
  80. disas.c
  81. dma-helpers.c
  82. dump.c
  83. exec.c
  84. gdbstub.c
  85. HACKING
  86. hmp-commands.hx
  87. hmp.c
  88. hmp.h
  89. iohandler.c
  90. ioport.c
  91. kvm-all.c
  92. kvm-stub.c
  93. LICENSE
  94. main-loop.c
  95. MAINTAINERS
  96. Makefile
  97. Makefile.objs
  98. Makefile.target
  99. memory.c
  100. memory_mapping.c
  101. migration-exec.c
  102. migration-fd.c
  103. migration-rdma.c
  104. migration-tcp.c
  105. migration-unix.c
  106. migration.c
  107. monitor.c
  108. nbd.c
  109. os-posix.c
  110. os-win32.c
  111. page_cache.c
  112. qapi-schema.json
  113. qdev-monitor.c
  114. qdict-test-data.txt
  115. qemu-bridge-helper.c
  116. qemu-char.c
  117. qemu-coroutine-io.c
  118. qemu-coroutine-lock.c
  119. qemu-coroutine-sleep.c
  120. qemu-coroutine.c
  121. qemu-doc.texi
  122. qemu-file.c
  123. qemu-img-cmds.hx
  124. qemu-img.c
  125. qemu-img.texi
  126. qemu-io-cmds.c
  127. qemu-io.c
  128. qemu-log.c
  129. qemu-nbd.c
  130. qemu-nbd.texi
  131. qemu-options-wrapper.h
  132. qemu-options.h
  133. qemu-options.hx
  134. qemu-seccomp.c
  135. qemu-tech.texi
  136. qemu-timer.c
  137. qemu.nsi
  138. qemu.sasl
  139. qmp-commands.hx
  140. qmp.c
  141. qtest.c
  142. readline.c
  143. README
  144. rules.mak
  145. savevm.c
  146. spice-qemu-char.c
  147. tcg-runtime.c
  148. tci.c
  149. thread-pool.c
  150. thunk.c
  151. tpm.c
  152. trace-events
  153. translate-all.c
  154. translate-all.h
  155. user-exec.c
  156. VERSION
  157. version.rc
  158. vl.c
  159. vmstate.c
  160. xbzrle.c
  161. xen-all.c
  162. xen-mapcache.c
  163. xen-stub.c