scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / util / qemu-thread-win32.c
1 /*
2 * Win32 implementation for mutex/cond/thread functions
3 *
4 * Copyright Red Hat, Inc. 2010
5 *
6 * Author:
7 * Paolo Bonzini <pbonzini@redhat.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 *
12 */
13 #include "qemu/osdep.h"
14 #include "qemu-common.h"
15 #include "qemu/thread.h"
16 #include "qemu/notify.h"
17 #include <process.h>
18
19 static bool name_threads;
20
21 void qemu_thread_naming(bool enable)
22 {
23 /* But note we don't actually name them on Windows yet */
24 name_threads = enable;
25
26 fprintf(stderr, "qemu: thread naming not supported on this host\n");
27 }
28
29 static void error_exit(int err, const char *msg)
30 {
31 char *pstr;
32
33 FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ALLOCATE_BUFFER,
34 NULL, err, 0, (LPTSTR)&pstr, 2, NULL);
35 fprintf(stderr, "qemu: %s: %s\n", msg, pstr);
36 LocalFree(pstr);
37 abort();
38 }
39
40 void qemu_mutex_init(QemuMutex *mutex)
41 {
42 mutex->owner = 0;
43 InitializeCriticalSection(&mutex->lock);
44 }
45
46 void qemu_mutex_destroy(QemuMutex *mutex)
47 {
48 assert(mutex->owner == 0);
49 DeleteCriticalSection(&mutex->lock);
50 }
51
52 void qemu_mutex_lock(QemuMutex *mutex)
53 {
54 EnterCriticalSection(&mutex->lock);
55
56 /* Win32 CRITICAL_SECTIONs are recursive. Assert that we're not
57 * using them as such.
58 */
59 assert(mutex->owner == 0);
60 mutex->owner = GetCurrentThreadId();
61 }
62
63 int qemu_mutex_trylock(QemuMutex *mutex)
64 {
65 int owned;
66
67 owned = TryEnterCriticalSection(&mutex->lock);
68 if (owned) {
69 assert(mutex->owner == 0);
70 mutex->owner = GetCurrentThreadId();
71 }
72 return !owned;
73 }
74
75 void qemu_mutex_unlock(QemuMutex *mutex)
76 {
77 assert(mutex->owner == GetCurrentThreadId());
78 mutex->owner = 0;
79 LeaveCriticalSection(&mutex->lock);
80 }
81
82 void qemu_cond_init(QemuCond *cond)
83 {
84 memset(cond, 0, sizeof(*cond));
85
86 cond->sema = CreateSemaphore(NULL, 0, LONG_MAX, NULL);
87 if (!cond->sema) {
88 error_exit(GetLastError(), __func__);
89 }
90 cond->continue_event = CreateEvent(NULL, /* security */
91 FALSE, /* auto-reset */
92 FALSE, /* not signaled */
93 NULL); /* name */
94 if (!cond->continue_event) {
95 error_exit(GetLastError(), __func__);
96 }
97 }
98
99 void qemu_cond_destroy(QemuCond *cond)
100 {
101 BOOL result;
102 result = CloseHandle(cond->continue_event);
103 if (!result) {
104 error_exit(GetLastError(), __func__);
105 }
106 cond->continue_event = 0;
107 result = CloseHandle(cond->sema);
108 if (!result) {
109 error_exit(GetLastError(), __func__);
110 }
111 cond->sema = 0;
112 }
113
114 void qemu_cond_signal(QemuCond *cond)
115 {
116 DWORD result;
117
118 /*
119 * Signal only when there are waiters. cond->waiters is
120 * incremented by pthread_cond_wait under the external lock,
121 * so we are safe about that.
122 */
123 if (cond->waiters == 0) {
124 return;
125 }
126
127 /*
128 * Waiting threads decrement it outside the external lock, but
129 * only if another thread is executing pthread_cond_broadcast and
130 * has the mutex. So, it also cannot be decremented concurrently
131 * with this particular access.
132 */
133 cond->target = cond->waiters - 1;
134 result = SignalObjectAndWait(cond->sema, cond->continue_event,
135 INFINITE, FALSE);
136 if (result == WAIT_ABANDONED || result == WAIT_FAILED) {
137 error_exit(GetLastError(), __func__);
138 }
139 }
140
141 void qemu_cond_broadcast(QemuCond *cond)
142 {
143 BOOLEAN result;
144 /*
145 * As in pthread_cond_signal, access to cond->waiters and
146 * cond->target is locked via the external mutex.
147 */
148 if (cond->waiters == 0) {
149 return;
150 }
151
152 cond->target = 0;
153 result = ReleaseSemaphore(cond->sema, cond->waiters, NULL);
154 if (!result) {
155 error_exit(GetLastError(), __func__);
156 }
157
158 /*
159 * At this point all waiters continue. Each one takes its
160 * slice of the semaphore. Now it's our turn to wait: Since
161 * the external mutex is held, no thread can leave cond_wait,
162 * yet. For this reason, we can be sure that no thread gets
163 * a chance to eat *more* than one slice. OTOH, it means
164 * that the last waiter must send us a wake-up.
165 */
166 WaitForSingleObject(cond->continue_event, INFINITE);
167 }
168
169 void qemu_cond_wait(QemuCond *cond, QemuMutex *mutex)
170 {
171 /*
172 * This access is protected under the mutex.
173 */
174 cond->waiters++;
175
176 /*
177 * Unlock external mutex and wait for signal.
178 * NOTE: we've held mutex locked long enough to increment
179 * waiters count above, so there's no problem with
180 * leaving mutex unlocked before we wait on semaphore.
181 */
182 qemu_mutex_unlock(mutex);
183 WaitForSingleObject(cond->sema, INFINITE);
184
185 /* Now waiters must rendez-vous with the signaling thread and
186 * let it continue. For cond_broadcast this has heavy contention
187 * and triggers thundering herd. So goes life.
188 *
189 * Decrease waiters count. The mutex is not taken, so we have
190 * to do this atomically.
191 *
192 * All waiters contend for the mutex at the end of this function
193 * until the signaling thread relinquishes it. To ensure
194 * each waiter consumes exactly one slice of the semaphore,
195 * the signaling thread stops until it is told by the last
196 * waiter that it can go on.
197 */
198 if (InterlockedDecrement(&cond->waiters) == cond->target) {
199 SetEvent(cond->continue_event);
200 }
201
202 qemu_mutex_lock(mutex);
203 }
204
205 void qemu_sem_init(QemuSemaphore *sem, int init)
206 {
207 /* Manual reset. */
208 sem->sema = CreateSemaphore(NULL, init, LONG_MAX, NULL);
209 }
210
211 void qemu_sem_destroy(QemuSemaphore *sem)
212 {
213 CloseHandle(sem->sema);
214 }
215
216 void qemu_sem_post(QemuSemaphore *sem)
217 {
218 ReleaseSemaphore(sem->sema, 1, NULL);
219 }
220
221 int qemu_sem_timedwait(QemuSemaphore *sem, int ms)
222 {
223 int rc = WaitForSingleObject(sem->sema, ms);
224 if (rc == WAIT_OBJECT_0) {
225 return 0;
226 }
227 if (rc != WAIT_TIMEOUT) {
228 error_exit(GetLastError(), __func__);
229 }
230 return -1;
231 }
232
233 void qemu_sem_wait(QemuSemaphore *sem)
234 {
235 if (WaitForSingleObject(sem->sema, INFINITE) != WAIT_OBJECT_0) {
236 error_exit(GetLastError(), __func__);
237 }
238 }
239
240 /* Wrap a Win32 manual-reset event with a fast userspace path. The idea
241 * is to reset the Win32 event lazily, as part of a test-reset-test-wait
242 * sequence. Such a sequence is, indeed, how QemuEvents are used by
243 * RCU and other subsystems!
244 *
245 * Valid transitions:
246 * - free->set, when setting the event
247 * - busy->set, when setting the event, followed by futex_wake
248 * - set->free, when resetting the event
249 * - free->busy, when waiting
250 *
251 * set->busy does not happen (it can be observed from the outside but
252 * it really is set->free->busy).
253 *
254 * busy->free provably cannot happen; to enforce it, the set->free transition
255 * is done with an OR, which becomes a no-op if the event has concurrently
256 * transitioned to free or busy (and is faster than cmpxchg).
257 */
258
259 #define EV_SET 0
260 #define EV_FREE 1
261 #define EV_BUSY -1
262
263 void qemu_event_init(QemuEvent *ev, bool init)
264 {
265 /* Manual reset. */
266 ev->event = CreateEvent(NULL, TRUE, TRUE, NULL);
267 ev->value = (init ? EV_SET : EV_FREE);
268 }
269
270 void qemu_event_destroy(QemuEvent *ev)
271 {
272 CloseHandle(ev->event);
273 }
274
275 void qemu_event_set(QemuEvent *ev)
276 {
277 if (atomic_mb_read(&ev->value) != EV_SET) {
278 if (atomic_xchg(&ev->value, EV_SET) == EV_BUSY) {
279 /* There were waiters, wake them up. */
280 SetEvent(ev->event);
281 }
282 }
283 }
284
285 void qemu_event_reset(QemuEvent *ev)
286 {
287 if (atomic_mb_read(&ev->value) == EV_SET) {
288 /* If there was a concurrent reset (or even reset+wait),
289 * do nothing. Otherwise change EV_SET->EV_FREE.
290 */
291 atomic_or(&ev->value, EV_FREE);
292 }
293 }
294
295 void qemu_event_wait(QemuEvent *ev)
296 {
297 unsigned value;
298
299 value = atomic_mb_read(&ev->value);
300 if (value != EV_SET) {
301 if (value == EV_FREE) {
302 /* qemu_event_set is not yet going to call SetEvent, but we are
303 * going to do another check for EV_SET below when setting EV_BUSY.
304 * At that point it is safe to call WaitForSingleObject.
305 */
306 ResetEvent(ev->event);
307
308 /* Tell qemu_event_set that there are waiters. No need to retry
309 * because there cannot be a concurent busy->free transition.
310 * After the CAS, the event will be either set or busy.
311 */
312 if (atomic_cmpxchg(&ev->value, EV_FREE, EV_BUSY) == EV_SET) {
313 value = EV_SET;
314 } else {
315 value = EV_BUSY;
316 }
317 }
318 if (value == EV_BUSY) {
319 WaitForSingleObject(ev->event, INFINITE);
320 }
321 }
322 }
323
324 struct QemuThreadData {
325 /* Passed to win32_start_routine. */
326 void *(*start_routine)(void *);
327 void *arg;
328 short mode;
329 NotifierList exit;
330
331 /* Only used for joinable threads. */
332 bool exited;
333 void *ret;
334 CRITICAL_SECTION cs;
335 };
336
337 static bool atexit_registered;
338 static NotifierList main_thread_exit;
339
340 static __thread QemuThreadData *qemu_thread_data;
341
342 static void run_main_thread_exit(void)
343 {
344 notifier_list_notify(&main_thread_exit, NULL);
345 }
346
347 void qemu_thread_atexit_add(Notifier *notifier)
348 {
349 if (!qemu_thread_data) {
350 if (!atexit_registered) {
351 atexit_registered = true;
352 atexit(run_main_thread_exit);
353 }
354 notifier_list_add(&main_thread_exit, notifier);
355 } else {
356 notifier_list_add(&qemu_thread_data->exit, notifier);
357 }
358 }
359
360 void qemu_thread_atexit_remove(Notifier *notifier)
361 {
362 notifier_remove(notifier);
363 }
364
365 static unsigned __stdcall win32_start_routine(void *arg)
366 {
367 QemuThreadData *data = (QemuThreadData *) arg;
368 void *(*start_routine)(void *) = data->start_routine;
369 void *thread_arg = data->arg;
370
371 qemu_thread_data = data;
372 qemu_thread_exit(start_routine(thread_arg));
373 abort();
374 }
375
376 void qemu_thread_exit(void *arg)
377 {
378 QemuThreadData *data = qemu_thread_data;
379
380 notifier_list_notify(&data->exit, NULL);
381 if (data->mode == QEMU_THREAD_JOINABLE) {
382 data->ret = arg;
383 EnterCriticalSection(&data->cs);
384 data->exited = true;
385 LeaveCriticalSection(&data->cs);
386 } else {
387 g_free(data);
388 }
389 _endthreadex(0);
390 }
391
392 void *qemu_thread_join(QemuThread *thread)
393 {
394 QemuThreadData *data;
395 void *ret;
396 HANDLE handle;
397
398 data = thread->data;
399 if (data->mode == QEMU_THREAD_DETACHED) {
400 return NULL;
401 }
402
403 /*
404 * Because multiple copies of the QemuThread can exist via
405 * qemu_thread_get_self, we need to store a value that cannot
406 * leak there. The simplest, non racy way is to store the TID,
407 * discard the handle that _beginthreadex gives back, and
408 * get another copy of the handle here.
409 */
410 handle = qemu_thread_get_handle(thread);
411 if (handle) {
412 WaitForSingleObject(handle, INFINITE);
413 CloseHandle(handle);
414 }
415 ret = data->ret;
416 DeleteCriticalSection(&data->cs);
417 g_free(data);
418 return ret;
419 }
420
421 void qemu_thread_create(QemuThread *thread, const char *name,
422 void *(*start_routine)(void *),
423 void *arg, int mode)
424 {
425 HANDLE hThread;
426 struct QemuThreadData *data;
427
428 data = g_malloc(sizeof *data);
429 data->start_routine = start_routine;
430 data->arg = arg;
431 data->mode = mode;
432 data->exited = false;
433 notifier_list_init(&data->exit);
434
435 if (data->mode != QEMU_THREAD_DETACHED) {
436 InitializeCriticalSection(&data->cs);
437 }
438
439 hThread = (HANDLE) _beginthreadex(NULL, 0, win32_start_routine,
440 data, 0, &thread->tid);
441 if (!hThread) {
442 error_exit(GetLastError(), __func__);
443 }
444 CloseHandle(hThread);
445 thread->data = data;
446 }
447
448 void qemu_thread_get_self(QemuThread *thread)
449 {
450 thread->data = qemu_thread_data;
451 thread->tid = GetCurrentThreadId();
452 }
453
454 HANDLE qemu_thread_get_handle(QemuThread *thread)
455 {
456 QemuThreadData *data;
457 HANDLE handle;
458
459 data = thread->data;
460 if (data->mode == QEMU_THREAD_DETACHED) {
461 return NULL;
462 }
463
464 EnterCriticalSection(&data->cs);
465 if (!data->exited) {
466 handle = OpenThread(SYNCHRONIZE | THREAD_SUSPEND_RESUME, FALSE,
467 thread->tid);
468 } else {
469 handle = NULL;
470 }
471 LeaveCriticalSection(&data->cs);
472 return handle;
473 }
474
475 bool qemu_thread_is_self(QemuThread *thread)
476 {
477 return GetCurrentThreadId() == thread->tid;
478 }