m25p80: don't let rogue SPI controllers cause buffer overruns
[qemu.git] / main-loop.c
1 /*
2 * QEMU System Emulator
3 *
4 * Copyright (c) 2003-2008 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
25 #include "qemu/osdep.h"
26 #include "qapi/error.h"
27 #include "qemu/cutils.h"
28 #include "qemu/timer.h"
29 #include "qemu/sockets.h" // struct in_addr needed for libslirp.h
30 #include "sysemu/qtest.h"
31 #include "slirp/libslirp.h"
32 #include "qemu/main-loop.h"
33 #include "block/aio.h"
34
35 #ifndef _WIN32
36
37 #include "qemu/compatfd.h"
38
39 /* If we have signalfd, we mask out the signals we want to handle and then
40 * use signalfd to listen for them. We rely on whatever the current signal
41 * handler is to dispatch the signals when we receive them.
42 */
43 static void sigfd_handler(void *opaque)
44 {
45 int fd = (intptr_t)opaque;
46 struct qemu_signalfd_siginfo info;
47 struct sigaction action;
48 ssize_t len;
49
50 while (1) {
51 do {
52 len = read(fd, &info, sizeof(info));
53 } while (len == -1 && errno == EINTR);
54
55 if (len == -1 && errno == EAGAIN) {
56 break;
57 }
58
59 if (len != sizeof(info)) {
60 printf("read from sigfd returned %zd: %m\n", len);
61 return;
62 }
63
64 sigaction(info.ssi_signo, NULL, &action);
65 if ((action.sa_flags & SA_SIGINFO) && action.sa_sigaction) {
66 action.sa_sigaction(info.ssi_signo,
67 (siginfo_t *)&info, NULL);
68 } else if (action.sa_handler) {
69 action.sa_handler(info.ssi_signo);
70 }
71 }
72 }
73
74 static int qemu_signal_init(void)
75 {
76 int sigfd;
77 sigset_t set;
78
79 /*
80 * SIG_IPI must be blocked in the main thread and must not be caught
81 * by sigwait() in the signal thread. Otherwise, the cpu thread will
82 * not catch it reliably.
83 */
84 sigemptyset(&set);
85 sigaddset(&set, SIG_IPI);
86 sigaddset(&set, SIGIO);
87 sigaddset(&set, SIGALRM);
88 sigaddset(&set, SIGBUS);
89 /* SIGINT cannot be handled via signalfd, so that ^C can be used
90 * to interrupt QEMU when it is being run under gdb. SIGHUP and
91 * SIGTERM are also handled asynchronously, even though it is not
92 * strictly necessary, because they use the same handler as SIGINT.
93 */
94 pthread_sigmask(SIG_BLOCK, &set, NULL);
95
96 sigdelset(&set, SIG_IPI);
97 sigfd = qemu_signalfd(&set);
98 if (sigfd == -1) {
99 fprintf(stderr, "failed to create signalfd\n");
100 return -errno;
101 }
102
103 fcntl_setfl(sigfd, O_NONBLOCK);
104
105 qemu_set_fd_handler(sigfd, sigfd_handler, NULL, (void *)(intptr_t)sigfd);
106
107 return 0;
108 }
109
110 #else /* _WIN32 */
111
112 static int qemu_signal_init(void)
113 {
114 return 0;
115 }
116 #endif
117
118 static AioContext *qemu_aio_context;
119 static QEMUBH *qemu_notify_bh;
120
121 static void notify_event_cb(void *opaque)
122 {
123 /* No need to do anything; this bottom half is only used to
124 * kick the kernel out of ppoll/poll/WaitForMultipleObjects.
125 */
126 }
127
128 AioContext *qemu_get_aio_context(void)
129 {
130 return qemu_aio_context;
131 }
132
133 void qemu_notify_event(void)
134 {
135 if (!qemu_aio_context) {
136 return;
137 }
138 qemu_bh_schedule(qemu_notify_bh);
139 }
140
141 static GArray *gpollfds;
142
143 int qemu_init_main_loop(Error **errp)
144 {
145 int ret;
146 GSource *src;
147 Error *local_error = NULL;
148
149 init_clocks();
150
151 ret = qemu_signal_init();
152 if (ret) {
153 return ret;
154 }
155
156 qemu_aio_context = aio_context_new(&local_error);
157 if (!qemu_aio_context) {
158 error_propagate(errp, local_error);
159 return -EMFILE;
160 }
161 qemu_notify_bh = qemu_bh_new(notify_event_cb, NULL);
162 gpollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));
163 src = aio_get_g_source(qemu_aio_context);
164 g_source_set_name(src, "aio-context");
165 g_source_attach(src, NULL);
166 g_source_unref(src);
167 src = iohandler_get_g_source();
168 g_source_set_name(src, "io-handler");
169 g_source_attach(src, NULL);
170 g_source_unref(src);
171 return 0;
172 }
173
174 static int max_priority;
175
176 #ifndef _WIN32
177 static int glib_pollfds_idx;
178 static int glib_n_poll_fds;
179
180 static void glib_pollfds_fill(int64_t *cur_timeout)
181 {
182 GMainContext *context = g_main_context_default();
183 int timeout = 0;
184 int64_t timeout_ns;
185 int n;
186
187 g_main_context_prepare(context, &max_priority);
188
189 glib_pollfds_idx = gpollfds->len;
190 n = glib_n_poll_fds;
191 do {
192 GPollFD *pfds;
193 glib_n_poll_fds = n;
194 g_array_set_size(gpollfds, glib_pollfds_idx + glib_n_poll_fds);
195 pfds = &g_array_index(gpollfds, GPollFD, glib_pollfds_idx);
196 n = g_main_context_query(context, max_priority, &timeout, pfds,
197 glib_n_poll_fds);
198 } while (n != glib_n_poll_fds);
199
200 if (timeout < 0) {
201 timeout_ns = -1;
202 } else {
203 timeout_ns = (int64_t)timeout * (int64_t)SCALE_MS;
204 }
205
206 *cur_timeout = qemu_soonest_timeout(timeout_ns, *cur_timeout);
207 }
208
209 static void glib_pollfds_poll(void)
210 {
211 GMainContext *context = g_main_context_default();
212 GPollFD *pfds = &g_array_index(gpollfds, GPollFD, glib_pollfds_idx);
213
214 if (g_main_context_check(context, max_priority, pfds, glib_n_poll_fds)) {
215 g_main_context_dispatch(context);
216 }
217 }
218
219 #define MAX_MAIN_LOOP_SPIN (1000)
220
221 static int os_host_main_loop_wait(int64_t timeout)
222 {
223 int ret;
224 static int spin_counter;
225
226 glib_pollfds_fill(&timeout);
227
228 /* If the I/O thread is very busy or we are incorrectly busy waiting in
229 * the I/O thread, this can lead to starvation of the BQL such that the
230 * VCPU threads never run. To make sure we can detect the later case,
231 * print a message to the screen. If we run into this condition, create
232 * a fake timeout in order to give the VCPU threads a chance to run.
233 */
234 if (!timeout && (spin_counter > MAX_MAIN_LOOP_SPIN)) {
235 static bool notified;
236
237 if (!notified && !qtest_enabled() && !qtest_driver()) {
238 fprintf(stderr,
239 "main-loop: WARNING: I/O thread spun for %d iterations\n",
240 MAX_MAIN_LOOP_SPIN);
241 notified = true;
242 }
243
244 timeout = SCALE_MS;
245 }
246
247 if (timeout) {
248 spin_counter = 0;
249 qemu_mutex_unlock_iothread();
250 } else {
251 spin_counter++;
252 }
253
254 ret = qemu_poll_ns((GPollFD *)gpollfds->data, gpollfds->len, timeout);
255
256 if (timeout) {
257 qemu_mutex_lock_iothread();
258 }
259
260 glib_pollfds_poll();
261 return ret;
262 }
263 #else
264 /***********************************************************/
265 /* Polling handling */
266
267 typedef struct PollingEntry {
268 PollingFunc *func;
269 void *opaque;
270 struct PollingEntry *next;
271 } PollingEntry;
272
273 static PollingEntry *first_polling_entry;
274
275 int qemu_add_polling_cb(PollingFunc *func, void *opaque)
276 {
277 PollingEntry **ppe, *pe;
278 pe = g_malloc0(sizeof(PollingEntry));
279 pe->func = func;
280 pe->opaque = opaque;
281 for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next);
282 *ppe = pe;
283 return 0;
284 }
285
286 void qemu_del_polling_cb(PollingFunc *func, void *opaque)
287 {
288 PollingEntry **ppe, *pe;
289 for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next) {
290 pe = *ppe;
291 if (pe->func == func && pe->opaque == opaque) {
292 *ppe = pe->next;
293 g_free(pe);
294 break;
295 }
296 }
297 }
298
299 /***********************************************************/
300 /* Wait objects support */
301 typedef struct WaitObjects {
302 int num;
303 int revents[MAXIMUM_WAIT_OBJECTS + 1];
304 HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
305 WaitObjectFunc *func[MAXIMUM_WAIT_OBJECTS + 1];
306 void *opaque[MAXIMUM_WAIT_OBJECTS + 1];
307 } WaitObjects;
308
309 static WaitObjects wait_objects = {0};
310
311 int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
312 {
313 WaitObjects *w = &wait_objects;
314 if (w->num >= MAXIMUM_WAIT_OBJECTS) {
315 return -1;
316 }
317 w->events[w->num] = handle;
318 w->func[w->num] = func;
319 w->opaque[w->num] = opaque;
320 w->revents[w->num] = 0;
321 w->num++;
322 return 0;
323 }
324
325 void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
326 {
327 int i, found;
328 WaitObjects *w = &wait_objects;
329
330 found = 0;
331 for (i = 0; i < w->num; i++) {
332 if (w->events[i] == handle) {
333 found = 1;
334 }
335 if (found) {
336 w->events[i] = w->events[i + 1];
337 w->func[i] = w->func[i + 1];
338 w->opaque[i] = w->opaque[i + 1];
339 w->revents[i] = w->revents[i + 1];
340 }
341 }
342 if (found) {
343 w->num--;
344 }
345 }
346
347 void qemu_fd_register(int fd)
348 {
349 WSAEventSelect(fd, event_notifier_get_handle(&qemu_aio_context->notifier),
350 FD_READ | FD_ACCEPT | FD_CLOSE |
351 FD_CONNECT | FD_WRITE | FD_OOB);
352 }
353
354 static int pollfds_fill(GArray *pollfds, fd_set *rfds, fd_set *wfds,
355 fd_set *xfds)
356 {
357 int nfds = -1;
358 int i;
359
360 for (i = 0; i < pollfds->len; i++) {
361 GPollFD *pfd = &g_array_index(pollfds, GPollFD, i);
362 int fd = pfd->fd;
363 int events = pfd->events;
364 if (events & G_IO_IN) {
365 FD_SET(fd, rfds);
366 nfds = MAX(nfds, fd);
367 }
368 if (events & G_IO_OUT) {
369 FD_SET(fd, wfds);
370 nfds = MAX(nfds, fd);
371 }
372 if (events & G_IO_PRI) {
373 FD_SET(fd, xfds);
374 nfds = MAX(nfds, fd);
375 }
376 }
377 return nfds;
378 }
379
380 static void pollfds_poll(GArray *pollfds, int nfds, fd_set *rfds,
381 fd_set *wfds, fd_set *xfds)
382 {
383 int i;
384
385 for (i = 0; i < pollfds->len; i++) {
386 GPollFD *pfd = &g_array_index(pollfds, GPollFD, i);
387 int fd = pfd->fd;
388 int revents = 0;
389
390 if (FD_ISSET(fd, rfds)) {
391 revents |= G_IO_IN;
392 }
393 if (FD_ISSET(fd, wfds)) {
394 revents |= G_IO_OUT;
395 }
396 if (FD_ISSET(fd, xfds)) {
397 revents |= G_IO_PRI;
398 }
399 pfd->revents = revents & pfd->events;
400 }
401 }
402
403 static int os_host_main_loop_wait(int64_t timeout)
404 {
405 GMainContext *context = g_main_context_default();
406 GPollFD poll_fds[1024 * 2]; /* this is probably overkill */
407 int select_ret = 0;
408 int g_poll_ret, ret, i, n_poll_fds;
409 PollingEntry *pe;
410 WaitObjects *w = &wait_objects;
411 gint poll_timeout;
412 int64_t poll_timeout_ns;
413 static struct timeval tv0;
414 fd_set rfds, wfds, xfds;
415 int nfds;
416
417 /* XXX: need to suppress polling by better using win32 events */
418 ret = 0;
419 for (pe = first_polling_entry; pe != NULL; pe = pe->next) {
420 ret |= pe->func(pe->opaque);
421 }
422 if (ret != 0) {
423 return ret;
424 }
425
426 FD_ZERO(&rfds);
427 FD_ZERO(&wfds);
428 FD_ZERO(&xfds);
429 nfds = pollfds_fill(gpollfds, &rfds, &wfds, &xfds);
430 if (nfds >= 0) {
431 select_ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv0);
432 if (select_ret != 0) {
433 timeout = 0;
434 }
435 if (select_ret > 0) {
436 pollfds_poll(gpollfds, nfds, &rfds, &wfds, &xfds);
437 }
438 }
439
440 g_main_context_prepare(context, &max_priority);
441 n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
442 poll_fds, ARRAY_SIZE(poll_fds));
443 g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
444
445 for (i = 0; i < w->num; i++) {
446 poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
447 poll_fds[n_poll_fds + i].events = G_IO_IN;
448 }
449
450 if (poll_timeout < 0) {
451 poll_timeout_ns = -1;
452 } else {
453 poll_timeout_ns = (int64_t)poll_timeout * (int64_t)SCALE_MS;
454 }
455
456 poll_timeout_ns = qemu_soonest_timeout(poll_timeout_ns, timeout);
457
458 qemu_mutex_unlock_iothread();
459 g_poll_ret = qemu_poll_ns(poll_fds, n_poll_fds + w->num, poll_timeout_ns);
460
461 qemu_mutex_lock_iothread();
462 if (g_poll_ret > 0) {
463 for (i = 0; i < w->num; i++) {
464 w->revents[i] = poll_fds[n_poll_fds + i].revents;
465 }
466 for (i = 0; i < w->num; i++) {
467 if (w->revents[i] && w->func[i]) {
468 w->func[i](w->opaque[i]);
469 }
470 }
471 }
472
473 if (g_main_context_check(context, max_priority, poll_fds, n_poll_fds)) {
474 g_main_context_dispatch(context);
475 }
476
477 return select_ret || g_poll_ret;
478 }
479 #endif
480
481 int main_loop_wait(int nonblocking)
482 {
483 int ret;
484 uint32_t timeout = UINT32_MAX;
485 int64_t timeout_ns;
486
487 if (nonblocking) {
488 timeout = 0;
489 }
490
491 /* poll any events */
492 g_array_set_size(gpollfds, 0); /* reset for new iteration */
493 /* XXX: separate device handlers from system ones */
494 #ifdef CONFIG_SLIRP
495 slirp_pollfds_fill(gpollfds, &timeout);
496 #endif
497
498 if (timeout == UINT32_MAX) {
499 timeout_ns = -1;
500 } else {
501 timeout_ns = (uint64_t)timeout * (int64_t)(SCALE_MS);
502 }
503
504 timeout_ns = qemu_soonest_timeout(timeout_ns,
505 timerlistgroup_deadline_ns(
506 &main_loop_tlg));
507
508 ret = os_host_main_loop_wait(timeout_ns);
509 #ifdef CONFIG_SLIRP
510 slirp_pollfds_poll(gpollfds, (ret < 0));
511 #endif
512
513 /* CPU thread can infinitely wait for event after
514 missing the warp */
515 qemu_start_warp_timer();
516 qemu_clock_run_all_timers();
517
518 return ret;
519 }
520
521 /* Functions to operate on the main QEMU AioContext. */
522
523 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
524 {
525 return aio_bh_new(qemu_aio_context, cb, opaque);
526 }