scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / cpu-exec-common.c
1 /*
2 * emulator main execution loop
3 *
4 * Copyright (c) 2003-2005 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "qemu/osdep.h"
21 #include "cpu.h"
22 #include "sysemu/cpus.h"
23 #include "exec/exec-all.h"
24 #include "exec/memory-internal.h"
25
26 bool exit_request;
27 CPUState *tcg_current_cpu;
28
29 /* exit the current TB from a signal handler. The host registers are
30 restored in a state compatible with the CPU emulator
31 */
32 #if defined(CONFIG_SOFTMMU)
33 void cpu_resume_from_signal(CPUState *cpu, void *puc)
34 {
35 /* XXX: restore cpu registers saved in host registers */
36
37 cpu->exception_index = -1;
38 siglongjmp(cpu->jmp_env, 1);
39 }
40
41 void cpu_reloading_memory_map(void)
42 {
43 if (qemu_in_vcpu_thread()) {
44 /* The guest can in theory prolong the RCU critical section as long
45 * as it feels like. The major problem with this is that because it
46 * can do multiple reconfigurations of the memory map within the
47 * critical section, we could potentially accumulate an unbounded
48 * collection of memory data structures awaiting reclamation.
49 *
50 * Because the only thing we're currently protecting with RCU is the
51 * memory data structures, it's sufficient to break the critical section
52 * in this callback, which we know will get called every time the
53 * memory map is rearranged.
54 *
55 * (If we add anything else in the system that uses RCU to protect
56 * its data structures, we will need to implement some other mechanism
57 * to force TCG CPUs to exit the critical section, at which point this
58 * part of this callback might become unnecessary.)
59 *
60 * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
61 * only protects cpu->as->dispatch. Since we know our caller is about
62 * to reload it, it's safe to split the critical section.
63 */
64 rcu_read_unlock();
65 rcu_read_lock();
66 }
67 }
68 #endif
69
70 void cpu_loop_exit(CPUState *cpu)
71 {
72 siglongjmp(cpu->jmp_env, 1);
73 }
74
75 void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
76 {
77 if (pc) {
78 cpu_restore_state(cpu, pc);
79 }
80 siglongjmp(cpu->jmp_env, 1);
81 }