]> git.proxmox.com Git - mirror_qemu.git/blob - aio-posix.c
aio-posix: avoid NULL pointer dereference in aio_epoll_update
[mirror_qemu.git] / aio-posix.c
1 /*
2 * QEMU aio implementation
3 *
4 * Copyright IBM, Corp. 2008
5 *
6 * Authors:
7 * Anthony Liguori <aliguori@us.ibm.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
11 *
12 * Contributions after 2012-01-13 are licensed under the terms of the
13 * GNU GPL, version 2 or (at your option) any later version.
14 */
15
16 #include "qemu/osdep.h"
17 #include "qemu-common.h"
18 #include "block/block.h"
19 #include "qemu/queue.h"
20 #include "qemu/sockets.h"
21 #ifdef CONFIG_EPOLL_CREATE1
22 #include <sys/epoll.h>
23 #endif
24
25 struct AioHandler
26 {
27 GPollFD pfd;
28 IOHandler *io_read;
29 IOHandler *io_write;
30 int deleted;
31 void *opaque;
32 bool is_external;
33 QLIST_ENTRY(AioHandler) node;
34 };
35
36 #ifdef CONFIG_EPOLL_CREATE1
37
38 /* The fd number threashold to switch to epoll */
39 #define EPOLL_ENABLE_THRESHOLD 64
40
41 static void aio_epoll_disable(AioContext *ctx)
42 {
43 ctx->epoll_available = false;
44 if (!ctx->epoll_enabled) {
45 return;
46 }
47 ctx->epoll_enabled = false;
48 close(ctx->epollfd);
49 }
50
51 static inline int epoll_events_from_pfd(int pfd_events)
52 {
53 return (pfd_events & G_IO_IN ? EPOLLIN : 0) |
54 (pfd_events & G_IO_OUT ? EPOLLOUT : 0) |
55 (pfd_events & G_IO_HUP ? EPOLLHUP : 0) |
56 (pfd_events & G_IO_ERR ? EPOLLERR : 0);
57 }
58
59 static bool aio_epoll_try_enable(AioContext *ctx)
60 {
61 AioHandler *node;
62 struct epoll_event event;
63
64 QLIST_FOREACH(node, &ctx->aio_handlers, node) {
65 int r;
66 if (node->deleted || !node->pfd.events) {
67 continue;
68 }
69 event.events = epoll_events_from_pfd(node->pfd.events);
70 event.data.ptr = node;
71 r = epoll_ctl(ctx->epollfd, EPOLL_CTL_ADD, node->pfd.fd, &event);
72 if (r) {
73 return false;
74 }
75 }
76 ctx->epoll_enabled = true;
77 return true;
78 }
79
80 static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new)
81 {
82 struct epoll_event event;
83 int r;
84
85 if (!ctx->epoll_enabled) {
86 return;
87 }
88 if (!node->pfd.events) {
89 r = epoll_ctl(ctx->epollfd, EPOLL_CTL_DEL, node->pfd.fd, &event);
90 if (r) {
91 aio_epoll_disable(ctx);
92 }
93 } else {
94 event.data.ptr = node;
95 event.events = epoll_events_from_pfd(node->pfd.events);
96 if (is_new) {
97 r = epoll_ctl(ctx->epollfd, EPOLL_CTL_ADD, node->pfd.fd, &event);
98 if (r) {
99 aio_epoll_disable(ctx);
100 }
101 } else {
102 r = epoll_ctl(ctx->epollfd, EPOLL_CTL_MOD, node->pfd.fd, &event);
103 if (r) {
104 aio_epoll_disable(ctx);
105 }
106 }
107 }
108 }
109
110 static int aio_epoll(AioContext *ctx, GPollFD *pfds,
111 unsigned npfd, int64_t timeout)
112 {
113 AioHandler *node;
114 int i, ret = 0;
115 struct epoll_event events[128];
116
117 assert(npfd == 1);
118 assert(pfds[0].fd == ctx->epollfd);
119 if (timeout > 0) {
120 ret = qemu_poll_ns(pfds, npfd, timeout);
121 }
122 if (timeout <= 0 || ret > 0) {
123 ret = epoll_wait(ctx->epollfd, events,
124 sizeof(events) / sizeof(events[0]),
125 timeout);
126 if (ret <= 0) {
127 goto out;
128 }
129 for (i = 0; i < ret; i++) {
130 int ev = events[i].events;
131 node = events[i].data.ptr;
132 node->pfd.revents = (ev & EPOLLIN ? G_IO_IN : 0) |
133 (ev & EPOLLOUT ? G_IO_OUT : 0) |
134 (ev & EPOLLHUP ? G_IO_HUP : 0) |
135 (ev & EPOLLERR ? G_IO_ERR : 0);
136 }
137 }
138 out:
139 return ret;
140 }
141
142 static bool aio_epoll_enabled(AioContext *ctx)
143 {
144 /* Fall back to ppoll when external clients are disabled. */
145 return !aio_external_disabled(ctx) && ctx->epoll_enabled;
146 }
147
148 static bool aio_epoll_check_poll(AioContext *ctx, GPollFD *pfds,
149 unsigned npfd, int64_t timeout)
150 {
151 if (!ctx->epoll_available) {
152 return false;
153 }
154 if (aio_epoll_enabled(ctx)) {
155 return true;
156 }
157 if (npfd >= EPOLL_ENABLE_THRESHOLD) {
158 if (aio_epoll_try_enable(ctx)) {
159 return true;
160 } else {
161 aio_epoll_disable(ctx);
162 }
163 }
164 return false;
165 }
166
167 #else
168
169 static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new)
170 {
171 }
172
173 static int aio_epoll(AioContext *ctx, GPollFD *pfds,
174 unsigned npfd, int64_t timeout)
175 {
176 assert(false);
177 }
178
179 static bool aio_epoll_enabled(AioContext *ctx)
180 {
181 return false;
182 }
183
184 static bool aio_epoll_check_poll(AioContext *ctx, GPollFD *pfds,
185 unsigned npfd, int64_t timeout)
186 {
187 return false;
188 }
189
190 #endif
191
192 static AioHandler *find_aio_handler(AioContext *ctx, int fd)
193 {
194 AioHandler *node;
195
196 QLIST_FOREACH(node, &ctx->aio_handlers, node) {
197 if (node->pfd.fd == fd)
198 if (!node->deleted)
199 return node;
200 }
201
202 return NULL;
203 }
204
205 void aio_set_fd_handler(AioContext *ctx,
206 int fd,
207 bool is_external,
208 IOHandler *io_read,
209 IOHandler *io_write,
210 void *opaque)
211 {
212 AioHandler *node;
213 bool is_new = false;
214 bool deleted = false;
215
216 node = find_aio_handler(ctx, fd);
217
218 /* Are we deleting the fd handler? */
219 if (!io_read && !io_write) {
220 if (node == NULL) {
221 return;
222 }
223
224 g_source_remove_poll(&ctx->source, &node->pfd);
225
226 /* If the lock is held, just mark the node as deleted */
227 if (ctx->walking_handlers) {
228 node->deleted = 1;
229 node->pfd.revents = 0;
230 } else {
231 /* Otherwise, delete it for real. We can't just mark it as
232 * deleted because deleted nodes are only cleaned up after
233 * releasing the walking_handlers lock.
234 */
235 QLIST_REMOVE(node, node);
236 deleted = true;
237 }
238 } else {
239 if (node == NULL) {
240 /* Alloc and insert if it's not already there */
241 node = g_new0(AioHandler, 1);
242 node->pfd.fd = fd;
243 QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);
244
245 g_source_add_poll(&ctx->source, &node->pfd);
246 is_new = true;
247 }
248 /* Update handler with latest information */
249 node->io_read = io_read;
250 node->io_write = io_write;
251 node->opaque = opaque;
252 node->is_external = is_external;
253
254 node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0);
255 node->pfd.events |= (io_write ? G_IO_OUT | G_IO_ERR : 0);
256 }
257
258 aio_epoll_update(ctx, node, is_new);
259 aio_notify(ctx);
260 if (deleted) {
261 g_free(node);
262 }
263 }
264
265 void aio_set_event_notifier(AioContext *ctx,
266 EventNotifier *notifier,
267 bool is_external,
268 EventNotifierHandler *io_read)
269 {
270 aio_set_fd_handler(ctx, event_notifier_get_fd(notifier),
271 is_external, (IOHandler *)io_read, NULL, notifier);
272 }
273
274 bool aio_prepare(AioContext *ctx)
275 {
276 return false;
277 }
278
279 bool aio_pending(AioContext *ctx)
280 {
281 AioHandler *node;
282
283 QLIST_FOREACH(node, &ctx->aio_handlers, node) {
284 int revents;
285
286 revents = node->pfd.revents & node->pfd.events;
287 if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read &&
288 aio_node_check(ctx, node->is_external)) {
289 return true;
290 }
291 if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write &&
292 aio_node_check(ctx, node->is_external)) {
293 return true;
294 }
295 }
296
297 return false;
298 }
299
300 bool aio_dispatch(AioContext *ctx)
301 {
302 AioHandler *node;
303 bool progress = false;
304
305 /*
306 * If there are callbacks left that have been queued, we need to call them.
307 * Do not call select in this case, because it is possible that the caller
308 * does not need a complete flush (as is the case for aio_poll loops).
309 */
310 if (aio_bh_poll(ctx)) {
311 progress = true;
312 }
313
314 /*
315 * We have to walk very carefully in case aio_set_fd_handler is
316 * called while we're walking.
317 */
318 node = QLIST_FIRST(&ctx->aio_handlers);
319 while (node) {
320 AioHandler *tmp;
321 int revents;
322
323 ctx->walking_handlers++;
324
325 revents = node->pfd.revents & node->pfd.events;
326 node->pfd.revents = 0;
327
328 if (!node->deleted &&
329 (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
330 aio_node_check(ctx, node->is_external) &&
331 node->io_read) {
332 node->io_read(node->opaque);
333
334 /* aio_notify() does not count as progress */
335 if (node->opaque != &ctx->notifier) {
336 progress = true;
337 }
338 }
339 if (!node->deleted &&
340 (revents & (G_IO_OUT | G_IO_ERR)) &&
341 aio_node_check(ctx, node->is_external) &&
342 node->io_write) {
343 node->io_write(node->opaque);
344 progress = true;
345 }
346
347 tmp = node;
348 node = QLIST_NEXT(node, node);
349
350 ctx->walking_handlers--;
351
352 if (!ctx->walking_handlers && tmp->deleted) {
353 QLIST_REMOVE(tmp, node);
354 g_free(tmp);
355 }
356 }
357
358 /* Run our timers */
359 progress |= timerlistgroup_run_timers(&ctx->tlg);
360
361 return progress;
362 }
363
364 /* These thread-local variables are used only in a small part of aio_poll
365 * around the call to the poll() system call. In particular they are not
366 * used while aio_poll is performing callbacks, which makes it much easier
367 * to think about reentrancy!
368 *
369 * Stack-allocated arrays would be perfect but they have size limitations;
370 * heap allocation is expensive enough that we want to reuse arrays across
371 * calls to aio_poll(). And because poll() has to be called without holding
372 * any lock, the arrays cannot be stored in AioContext. Thread-local data
373 * has none of the disadvantages of these three options.
374 */
375 static __thread GPollFD *pollfds;
376 static __thread AioHandler **nodes;
377 static __thread unsigned npfd, nalloc;
378 static __thread Notifier pollfds_cleanup_notifier;
379
380 static void pollfds_cleanup(Notifier *n, void *unused)
381 {
382 g_assert(npfd == 0);
383 g_free(pollfds);
384 g_free(nodes);
385 nalloc = 0;
386 }
387
388 static void add_pollfd(AioHandler *node)
389 {
390 if (npfd == nalloc) {
391 if (nalloc == 0) {
392 pollfds_cleanup_notifier.notify = pollfds_cleanup;
393 qemu_thread_atexit_add(&pollfds_cleanup_notifier);
394 nalloc = 8;
395 } else {
396 g_assert(nalloc <= INT_MAX);
397 nalloc *= 2;
398 }
399 pollfds = g_renew(GPollFD, pollfds, nalloc);
400 nodes = g_renew(AioHandler *, nodes, nalloc);
401 }
402 nodes[npfd] = node;
403 pollfds[npfd] = (GPollFD) {
404 .fd = node->pfd.fd,
405 .events = node->pfd.events,
406 };
407 npfd++;
408 }
409
410 bool aio_poll(AioContext *ctx, bool blocking)
411 {
412 AioHandler *node;
413 int i, ret;
414 bool progress;
415 int64_t timeout;
416
417 aio_context_acquire(ctx);
418 progress = false;
419
420 /* aio_notify can avoid the expensive event_notifier_set if
421 * everything (file descriptors, bottom halves, timers) will
422 * be re-evaluated before the next blocking poll(). This is
423 * already true when aio_poll is called with blocking == false;
424 * if blocking == true, it is only true after poll() returns,
425 * so disable the optimization now.
426 */
427 if (blocking) {
428 atomic_add(&ctx->notify_me, 2);
429 }
430
431 ctx->walking_handlers++;
432
433 assert(npfd == 0);
434
435 /* fill pollfds */
436
437 if (!aio_epoll_enabled(ctx)) {
438 QLIST_FOREACH(node, &ctx->aio_handlers, node) {
439 if (!node->deleted && node->pfd.events
440 && aio_node_check(ctx, node->is_external)) {
441 add_pollfd(node);
442 }
443 }
444 }
445
446 timeout = blocking ? aio_compute_timeout(ctx) : 0;
447
448 /* wait until next event */
449 if (timeout) {
450 aio_context_release(ctx);
451 }
452 if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) {
453 AioHandler epoll_handler;
454
455 epoll_handler.pfd.fd = ctx->epollfd;
456 epoll_handler.pfd.events = G_IO_IN | G_IO_OUT | G_IO_HUP | G_IO_ERR;
457 npfd = 0;
458 add_pollfd(&epoll_handler);
459 ret = aio_epoll(ctx, pollfds, npfd, timeout);
460 } else {
461 ret = qemu_poll_ns(pollfds, npfd, timeout);
462 }
463 if (blocking) {
464 atomic_sub(&ctx->notify_me, 2);
465 }
466 if (timeout) {
467 aio_context_acquire(ctx);
468 }
469
470 aio_notify_accept(ctx);
471
472 /* if we have any readable fds, dispatch event */
473 if (ret > 0) {
474 for (i = 0; i < npfd; i++) {
475 nodes[i]->pfd.revents = pollfds[i].revents;
476 }
477 }
478
479 npfd = 0;
480 ctx->walking_handlers--;
481
482 /* Run dispatch even if there were no readable fds to run timers */
483 if (aio_dispatch(ctx)) {
484 progress = true;
485 }
486
487 aio_context_release(ctx);
488
489 return progress;
490 }
491
492 void aio_context_setup(AioContext *ctx)
493 {
494 #ifdef CONFIG_EPOLL_CREATE1
495 assert(!ctx->epollfd);
496 ctx->epollfd = epoll_create1(EPOLL_CLOEXEC);
497 if (ctx->epollfd == -1) {
498 fprintf(stderr, "Failed to create epoll instance: %s", strerror(errno));
499 ctx->epoll_available = false;
500 } else {
501 ctx->epoll_available = true;
502 }
503 #endif
504 }