1*bbf15aafSRichard Henderson /* 2*bbf15aafSRichard Henderson * safe-syscall.h: prototypes for linux-user signal-race-safe syscalls 3*bbf15aafSRichard Henderson * 4*bbf15aafSRichard Henderson * This program is free software; you can redistribute it and/or modify 5*bbf15aafSRichard Henderson * it under the terms of the GNU General Public License as published by 6*bbf15aafSRichard Henderson * the Free Software Foundation; either version 2 of the License, or 7*bbf15aafSRichard Henderson * (at your option) any later version. 8*bbf15aafSRichard Henderson * 9*bbf15aafSRichard Henderson * This program is distributed in the hope that it will be useful, 10*bbf15aafSRichard Henderson * but WITHOUT ANY WARRANTY; without even the implied warranty of 11*bbf15aafSRichard Henderson * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12*bbf15aafSRichard Henderson * GNU General Public License for more details. 13*bbf15aafSRichard Henderson * 14*bbf15aafSRichard Henderson * You should have received a copy of the GNU General Public License 15*bbf15aafSRichard Henderson * along with this program; if not, see <http://www.gnu.org/licenses/>. 16*bbf15aafSRichard Henderson */ 17*bbf15aafSRichard Henderson 18*bbf15aafSRichard Henderson #ifndef LINUX_USER_SAFE_SYSCALL_H 19*bbf15aafSRichard Henderson #define LINUX_USER_SAFE_SYSCALL_H 20*bbf15aafSRichard Henderson 21*bbf15aafSRichard Henderson /** 22*bbf15aafSRichard Henderson * safe_syscall: 23*bbf15aafSRichard Henderson * @int number: number of system call to make 24*bbf15aafSRichard Henderson * ...: arguments to the system call 25*bbf15aafSRichard Henderson * 26*bbf15aafSRichard Henderson * Call a system call if guest signal not pending. 27*bbf15aafSRichard Henderson * This has the same API as the libc syscall() function, except that it 28*bbf15aafSRichard Henderson * may return -1 with errno == QEMU_ERESTARTSYS if a signal was pending. 29*bbf15aafSRichard Henderson * 30*bbf15aafSRichard Henderson * Returns: the system call result, or -1 with an error code in errno 31*bbf15aafSRichard Henderson * (Errnos are host errnos; we rely on QEMU_ERESTARTSYS not clashing 32*bbf15aafSRichard Henderson * with any of the host errno values.) 33*bbf15aafSRichard Henderson */ 34*bbf15aafSRichard Henderson 35*bbf15aafSRichard Henderson /* 36*bbf15aafSRichard Henderson * A guide to using safe_syscall() to handle interactions between guest 37*bbf15aafSRichard Henderson * syscalls and guest signals: 38*bbf15aafSRichard Henderson * 39*bbf15aafSRichard Henderson * Guest syscalls come in two flavours: 40*bbf15aafSRichard Henderson * 41*bbf15aafSRichard Henderson * (1) Non-interruptible syscalls 42*bbf15aafSRichard Henderson * 43*bbf15aafSRichard Henderson * These are guest syscalls that never get interrupted by signals and 44*bbf15aafSRichard Henderson * so never return EINTR. They can be implemented straightforwardly in 45*bbf15aafSRichard Henderson * QEMU: just make sure that if the implementation code has to make any 46*bbf15aafSRichard Henderson * blocking calls that those calls are retried if they return EINTR. 47*bbf15aafSRichard Henderson * It's also OK to implement these with safe_syscall, though it will be 48*bbf15aafSRichard Henderson * a little less efficient if a signal is delivered at the 'wrong' moment. 49*bbf15aafSRichard Henderson * 50*bbf15aafSRichard Henderson * Some non-interruptible syscalls need to be handled using block_signals() 51*bbf15aafSRichard Henderson * to block signals for the duration of the syscall. This mainly applies 52*bbf15aafSRichard Henderson * to code which needs to modify the data structures used by the 53*bbf15aafSRichard Henderson * host_signal_handler() function and the functions it calls, including 54*bbf15aafSRichard Henderson * all syscalls which change the thread's signal mask. 55*bbf15aafSRichard Henderson * 56*bbf15aafSRichard Henderson * (2) Interruptible syscalls 57*bbf15aafSRichard Henderson * 58*bbf15aafSRichard Henderson * These are guest syscalls that can be interrupted by signals and 59*bbf15aafSRichard Henderson * for which we need to either return EINTR or arrange for the guest 60*bbf15aafSRichard Henderson * syscall to be restarted. This category includes both syscalls which 61*bbf15aafSRichard Henderson * always restart (and in the kernel return -ERESTARTNOINTR), ones 62*bbf15aafSRichard Henderson * which only restart if there is no handler (kernel returns -ERESTARTNOHAND 63*bbf15aafSRichard Henderson * or -ERESTART_RESTARTBLOCK), and the most common kind which restart 64*bbf15aafSRichard Henderson * if the handler was registered with SA_RESTART (kernel returns 65*bbf15aafSRichard Henderson * -ERESTARTSYS). System calls which are only interruptible in some 66*bbf15aafSRichard Henderson * situations (like 'open') also need to be handled this way. 67*bbf15aafSRichard Henderson * 68*bbf15aafSRichard Henderson * Here it is important that the host syscall is made 69*bbf15aafSRichard Henderson * via this safe_syscall() function, and *not* via the host libc. 70*bbf15aafSRichard Henderson * If the host libc is used then the implementation will appear to work 71*bbf15aafSRichard Henderson * most of the time, but there will be a race condition where a 72*bbf15aafSRichard Henderson * signal could arrive just before we make the host syscall inside libc, 73*bbf15aafSRichard Henderson * and then then guest syscall will not correctly be interrupted. 74*bbf15aafSRichard Henderson * Instead the implementation of the guest syscall can use the safe_syscall 75*bbf15aafSRichard Henderson * function but otherwise just return the result or errno in the usual 76*bbf15aafSRichard Henderson * way; the main loop code will take care of restarting the syscall 77*bbf15aafSRichard Henderson * if appropriate. 78*bbf15aafSRichard Henderson * 79*bbf15aafSRichard Henderson * (If the implementation needs to make multiple host syscalls this is 80*bbf15aafSRichard Henderson * OK; any which might really block must be via safe_syscall(); for those 81*bbf15aafSRichard Henderson * which are only technically blocking (ie which we know in practice won't 82*bbf15aafSRichard Henderson * stay in the host kernel indefinitely) it's OK to use libc if necessary. 83*bbf15aafSRichard Henderson * You must be able to cope with backing out correctly if some safe_syscall 84*bbf15aafSRichard Henderson * you make in the implementation returns either -QEMU_ERESTARTSYS or 85*bbf15aafSRichard Henderson * EINTR though.) 86*bbf15aafSRichard Henderson * 87*bbf15aafSRichard Henderson * block_signals() cannot be used for interruptible syscalls. 88*bbf15aafSRichard Henderson * 89*bbf15aafSRichard Henderson * 90*bbf15aafSRichard Henderson * How and why the safe_syscall implementation works: 91*bbf15aafSRichard Henderson * 92*bbf15aafSRichard Henderson * The basic setup is that we make the host syscall via a known 93*bbf15aafSRichard Henderson * section of host native assembly. If a signal occurs, our signal 94*bbf15aafSRichard Henderson * handler checks the interrupted host PC against the addresse of that 95*bbf15aafSRichard Henderson * known section. If the PC is before or at the address of the syscall 96*bbf15aafSRichard Henderson * instruction then we change the PC to point at a "return 97*bbf15aafSRichard Henderson * -QEMU_ERESTARTSYS" code path instead, and then exit the signal handler 98*bbf15aafSRichard Henderson * (causing the safe_syscall() call to immediately return that value). 99*bbf15aafSRichard Henderson * Then in the main.c loop if we see this magic return value we adjust 100*bbf15aafSRichard Henderson * the guest PC to wind it back to before the system call, and invoke 101*bbf15aafSRichard Henderson * the guest signal handler as usual. 102*bbf15aafSRichard Henderson * 103*bbf15aafSRichard Henderson * This winding-back will happen in two cases: 104*bbf15aafSRichard Henderson * (1) signal came in just before we took the host syscall (a race); 105*bbf15aafSRichard Henderson * in this case we'll take the guest signal and have another go 106*bbf15aafSRichard Henderson * at the syscall afterwards, and this is indistinguishable for the 107*bbf15aafSRichard Henderson * guest from the timing having been different such that the guest 108*bbf15aafSRichard Henderson * signal really did win the race 109*bbf15aafSRichard Henderson * (2) signal came in while the host syscall was blocking, and the 110*bbf15aafSRichard Henderson * host kernel decided the syscall should be restarted; 111*bbf15aafSRichard Henderson * in this case we want to restart the guest syscall also, and so 112*bbf15aafSRichard Henderson * rewinding is the right thing. (Note that "restart" semantics mean 113*bbf15aafSRichard Henderson * "first call the signal handler, then reattempt the syscall".) 114*bbf15aafSRichard Henderson * The other situation to consider is when a signal came in while the 115*bbf15aafSRichard Henderson * host syscall was blocking, and the host kernel decided that the syscall 116*bbf15aafSRichard Henderson * should not be restarted; in this case QEMU's host signal handler will 117*bbf15aafSRichard Henderson * be invoked with the PC pointing just after the syscall instruction, 118*bbf15aafSRichard Henderson * with registers indicating an EINTR return; the special code in the 119*bbf15aafSRichard Henderson * handler will not kick in, and we will return EINTR to the guest as 120*bbf15aafSRichard Henderson * we should. 121*bbf15aafSRichard Henderson * 122*bbf15aafSRichard Henderson * Notice that we can leave the host kernel to make the decision for 123*bbf15aafSRichard Henderson * us about whether to do a restart of the syscall or not; we do not 124*bbf15aafSRichard Henderson * need to check SA_RESTART flags in QEMU or distinguish the various 125*bbf15aafSRichard Henderson * kinds of restartability. 126*bbf15aafSRichard Henderson */ 127*bbf15aafSRichard Henderson 128*bbf15aafSRichard Henderson /* The core part of this function is implemented in assembly */ 129*bbf15aafSRichard Henderson extern long safe_syscall_base(int *pending, long number, ...); 130*bbf15aafSRichard Henderson extern long safe_syscall_set_errno_tail(int value); 131*bbf15aafSRichard Henderson 132*bbf15aafSRichard Henderson /* These are defined by the safe-syscall.inc.S file */ 133*bbf15aafSRichard Henderson extern char safe_syscall_start[]; 134*bbf15aafSRichard Henderson extern char safe_syscall_end[]; 135*bbf15aafSRichard Henderson 136*bbf15aafSRichard Henderson #define safe_syscall(...) \ 137*bbf15aafSRichard Henderson safe_syscall_base(&((TaskState *)thread_cpu->opaque)->signal_pending, \ 138*bbf15aafSRichard Henderson __VA_ARGS__) 139*bbf15aafSRichard Henderson 140*bbf15aafSRichard Henderson #endif 141